Exception while creating project or organization with the dot after the end

[hmvs]

Preconditions:
Go to 'Add project' page
Steps to reproduce:

1. Type the project name slowly in 'Project Name' field
2. At the end of the name leave dot symbol
3. Browser will send OPTIONS request and server will return 404 response, and page will be redirected to the error page immediately

[niemyjski]

So I narrowed this down a bit more..

It appears that the server is never even hit and chrome / (and maybe firefox) never even send a request. It creates a preflight request for this but is rejected when the request ends in a period.

[hmvs]

I could be wrong, but i think chrome and firefox send it. It's just IIS server respond with 404. And as i can remember It could be fixed via web.config.

[niemyjski]

I think we may need to create a simple js sample of making a request and log a bug with chrome maybe. I don't see anyone else running into this but it's kind of crazy. I guess for now the work around would be to create it with a period and a second character and then after it's created try renaming it.

[niemyjski]

@hmvs could you look into it a bit more? I enabled EnableSystemDiagnosticsTracing and nothing was outputted (something should be written per request). I also didn't see anything in the chrome://net-internals/#events window.

[hmvs]

but response from the server is here:
Access-Control-Expose-Headers:ETag, Link, X-RateLimit-Limit, X-RateLimit-Remaining, X-Exceptionless-Client, X-Exceptionless-ConfigVersion
Cache-Control:private
Content-Length:1918
Content-Type:text/html; charset=utf-8
Date:Mon, 13 Jul 2015 21:12:14 GMT
Server:Microsoft-IIS/8.0
Set-Cookie:ARRAffinity=....... ;Path=/;Domain=api.exceptionless.io
X-AspNet-Version:4.0.30319

[hmvs]

you can disable https and try sniff some traffic. but i believe it's something with url parsing of IIS. so request even not passed to asp.net

[hmvs]

Just try this link
[https://api.exceptionless.io/api/v2/projects/check-name/Walle.]
And this
[https://api.exceptionless.io/api/v2/projects/check-name/Walle.D]

It's definitely IIS problem, not the browser one.

[niemyjski]

Yeah, just weird that nothing is written out when doing request level tracing. Thanks for posting that, I didn't even think of checking the response headers. I'll look more into config changes that could affect this.

[niemyjski]

I found the solution however, I'm not sure we want to enable it...

The solution is to set RelaxedUrlToFileSystemMapping to true as stated here. However there are a few warnings that this can open up your attack surface (http://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx and http://stackoverflow.com/questions/11642623/any-potential-security-risks-setting-with-turning-on-relaxedurltofilesystemmappi)

[niemyjski]

@ejsmith thoughts?

[ejsmith]

Seems like it could be a security issue and I'm really not sure why you would want a project name that ends with a period.

I think the real problem is us redirecting to the error page. We really need to fix that behaviour.

[niemyjski]

Yeah, we'll you might want Company LLC. which would fail. Yeah, I looked into that redirect behavior and it happens because the status is 0 and not 404 as reported in the chrome network tab.

[ejsmith]

I still say that you need to check the status before you redirect.

[niemyjski]

We do and in this case it's 0.