Search code examples
asp.net-coreiisasp.net-web-apiasp.net-core-2.2kestrel-http-server

Not able to use string over 260 characters as a segment of URL in .NET Core

I'm making a request that works great and acts as supposed to. The actual authorization is provided using headers and working as expected too. This is the URL of it.

https://localhost:44385/api/security/check

By coincidence, I happened to replace the verbatim string check with the actual token, so the URL changed to

https://localhost:44385/api/security/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ...

All in all, the token happens to be 475 characters long. Then, when executing that call, I get the error message as follows.

Error: connect ECONNREFUSED 127.0.0.1:44300

I don't understand the issue and the status code 400 tells me only that the request is bad. Is it purely due ot the length of the URL? It seems like a bit too short (although there is a limitation for that but we're talking about a few thousands characters)...

The signature of the receiving method in the controller looks like this. It resides in the controller with path Security.

[HttpHead("{check}"), Authorize]
public IActionResult IsAuthorized(string check) { ... }

I also tried GET instead of HEAD with the same result. It's difficult to learn more about the error based on 400 Bad request only. It's a bit like something went wrong somewhere kind of error.

After some experimenting, I can confirm that it's not the length of the URL as such but rather the length of the segment between slashes. The first request works, the other does too but the third doesn't. The xxx part is precisely 260 characters and **yyy* part is precisely 261.

https://localhost:44385/api/test/xxx
https://localhost:44385/api/testtest/xxx
https://localhost:44385/api/test/yyy

What is this about?! It's like string in a method in my WebAPI can't be longer than 260 characters. Not 256, which at least would make some kind of sense...

Googling gave a veeery wide range of vastly spread hits and gave me nothing that I could relate to. Postman provides pretty much the same, limited information. The browser's network tab give even less.

A bit confused how to get to know more, how to diagnose it further and/or what to google for. Since it's a non-problem for the production environment, I can't bother my colleagues - the question is purely academic.

Solution

  • The limit you're hitting is UrlSegmentMaxLength (260).

    This is all the way down in Http.Sys and only configurable in the registry.

    Workaround: break it up into multiple path segments, or move it to the query or body. Or use Kestrel without IIS.

    Resource: https://github.com/aspnet/AspNetCore/issues/2823#issuecomment-360921436

    Here's a related post: