ASP.NET Web API application returns HTTP 500 for non existant routes with TransferRequestHandler enabled

Question

I created a simple Web API app (empty template from Visual Studio with Web API enabled), added a controller:

[RoutePrefix("api/test")]
public class TestController : ApiController
{
    [HttpGet]
    [Route(@"resource/{*path?}")]
    public async Task<HttpResponseMessage> GetFolder(string path = "")
    {
        return this.Request.CreateResponse(HttpStatusCode.OK, new { Status = "OK" });
    }
}

Now we need to support file name extensions (e.g. file.pdf) in the path variable, so I modified the web.config:

<system.webServer>
  <handlers>
    <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
    <remove name="OPTIONSVerbHandler" />
    <remove name="TRACEVerbHandler" />
    <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

    <!-- API must handle all file names -->
    <add name="ApiUrlHandler" path="/api/test/*" verb="GET,POST,PUT,DELETE,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

  </handlers>
</system.webServer>

The problem now is that the HTTP status codes are inconsistents, depending on the URL segments provided after the prefix /api/test/:

GET /api/test/resource => HTTP 200 (as expected)
GET /api/test/resource/foo => HTTP 200 (as expected)
GET /api/test/foo => HTTP 404 (as expected)
GET /api/test/foo/bar => HTTP 500 (expected: 404)

The 500 error page is displayed in HTML and nothing is logged in the application logs, no exception thrown. I am using VS 2015, with .NET framework 4.5.1.

Answer 1

I am seeing this as well - and I see that my global.asax.cs "BeginRequest" and "EndRequest" is called around 10 times for requests like these. Looks like an ASP.NET/WebApi bug.

The solution I found was to register a "catch all" route with a controller that always returns a 404.

        config.Routes.MapHttpRoute(
            name: "CatchAllRoute",
            routeTemplate: "{*catchall}",
            defaults: new { controller = "UnrecognizedRoute", action = ApiConstants.UnrecognizedRouteAction });

...

public class UnrecognizedRouteController : ApiController
{
    /// <summary>
    /// This method is called for every single API request that comes to the API and is not routed
    /// </summary>
    [ActionName(ApiConstants.UnrecognizedRouteAction)]
    [HttpDelete, HttpGet, HttpHead, HttpOptions, HttpPost, HttpPatch, HttpPut]
    public IHttpActionResult ProcessUnrecognizedRoute()
    {
        return NotFound();
    }
}