Asp.Net MVC Core enabling double escape

Question

I am working on a asp.net mvc core application and trying to allow double escaping.

My Edit url has a phone number as hyperlink (Ex: +123). I know how to do with a normal asp.net mvc application. I used to change web.config file as

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="true"/>
    </security>
</system.webServer>

But I am right now on Asp.Net MVC Core application with out a web.config. How and where can I manage this?

Answer 1

ASP.NET Core application could be hosted on variety of web servers (IIS, Kestrel, Nginx, Apache, ...). All these web servers know nothing about request filtering (and particularly enabling of double escape) which is a native IIS feature. It's a hosting concern and ASP.NET Core application should not deal with it directly. If URL like http://youserver.com/Home/Phone/+12345 will reach ASP.NET Core pipeline, plus sign will not be treated in any special way and will get to string model as + character.

When you host your application on IIS, web.config is still in use, so you could configure <requestFiltering allowDoubleEscaping="true"/> as for usual ASP.NET application. Again, you should not be afraid that you do something in non ASP.NET Core way. You configure a hosting concern; it's not the field of ASP.NET Core.

If you want to host application in another Web server, you should check how it handle special characters. I know that Kestrel will just pass such URLs as is, so you don't need to take any specific actions if hosted on Kestrel.

Answer 2

You should use the web.config transformations - or you'll wipe it out next time you deploy and your customer will come back and say 'hey it broke again!'

Create a web.Release.config file (you don't need a web.config file in your actual project) with the following:

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <location>
    <system.webServer>

      <security xdt:Transform="InsertIfMissing">
        <requestFiltering allowDoubleEscaping="true" />
      </security>

    </system.webServer>
  </location>
</configuration>

When you publish a release build this will get added - as well as all of the aspNetCore handlers. Very important to include the part InsertIfMissing or it will be ignored.

You DON'T need a third party package such as this. 7