%09 in a URL causes IIS (HTTP.SYS?) to return HTTP 400 immediately

Question

I've discovered that IIS7, 7.5 and 8 (and probably previous versions too) will fail-fast when encountering any URL that contains %09 that is not part of a querystring.

StackOverflow itself exhibits the same behavior, observe:

http://www.stackoverflow.com/questions/%09

This is annoying for my application because I have built a web-service which should return text/xml for every request, even invalid ones, containing a specific XML document format containing error codes. I've found that some webservice clients pass the %09 (often caused by a user copying and pasting) to my service, but my server returns an ugly HTML response that seems hard-coded into HTTP.SYS (I overrode the HTTP 400 error response in IIS, but it has no effect).

Bad Request - Invalid URL

HTTP Error 400. The request URL is invalid.

Is there any workaround or solution for this?

Memorandum:

For comparison:

• Google serves a HTTP 404 correctly: https://www.google.com/%09
• Apache seems to let MediaWiki handle the error: http://en.wikipedia.org/wiki/Foo%09
• IIS doesn't: http://microsoft.com/download/%09

Answer 1

I found this other question which pointed me towards the Http.sys registry settings for Windows documentation and the AllowRestrictedChars registry key in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters. I've confirmed that setting this to 1 allows the request to pass through HTTP.SYS without being immediately rejected. IIS then sends back its own 400 page, but at least it reaches IIS and appears in the IIS logs. It may be possible to work further with the request to apply custom error pages and such at that point.