.NET MVC Routing w/ Url Encoding Problems

Question

I have the following routing code:

routes.MapRoute(
            "email-validated/{sessionId}",
            "email-validated/{sessionId}",
            new { controller = "User", action = "EmailValidated", sessionId = UrlParameter.Optional }
            );

When I hit the route w/ something that is url encoded it won't match the route for %2f, %2b and some other escaped characters. It also won't match for non url encoded (things w/ + etc) For instance

This works:

email-validated/XQiKC6KMM%2cmko4nOvzGRwPu9oaZFoCtXsFFJg3ZTf9S5rsBbLGjnz3FN3SJ0apEZcqK1PIcCY28mRMykB39XnFLKaL7390CDfLZiV77cso

This doesn't work ( containts %2f etc):

email-validated/XQiKC6KMM%2fmko4nOvzGRwPu9oaZFoCtXsFFJg3ZTf9S5rsBbLGjnz3FN3SJ0apEZcqK1PIcCY28mRMykB39XnFLKaL7390CDfLZiV77cso

This doesn't work (contains + etc)

email-validated/XQiKC6KMM+mko4nOvzGRwPu9oaZFoCtXsFFJg3ZTf9S5rsBbLGjnz3FN3SJ0apEZcqK1PIcCY28mRMykB39XnFLKaL7390CDfLZiV77cso

Answer 1

you can use System.Web.HttpServerUtility.UrlTokenEncode (from http://brockallen.com/2014/10/17/base64url-encoding/#comments)

Answer 2

Here's the solution I've found to allow url encoded characters like the forward slash %2f in Asp.Net MVC urls.

Add the following to the Application_BeginRequest method of your Global.asax file:

var realUrl = Request.ServerVariables["HTTP_URL"];
Context.RewritePath(realUrl);

Since this happens before MVC routing, you will be able to do what you originally wanted to do.

Just remember that you'll need to manually decode the parameters in your Action Methods to get their actual value (since we're preventing the framework from doing so).

Answer 3

It looks like the routing path handles escaped /'s and +'s weirdly. Try passing it in as a query string argument instead.

Make your endpoint:

routes.MapRoute(
            "email-validated",
            "email-validated",
            new { controller = "User", action = "EmailValidated" }
            );

Call it with a request like:

email-validated/?sessionId=XQiKC6KMM%2fmko4nOvzGRwPu9oaZFoCtXsFFJg3ZTf9S5rsBbLGjnz3FN3SJ0apEZcqK1PIcCY28mRMykB39XnFLKaL7390CDfLZiV77cso

And then change your function from

EmailValidatedFunction(string sessionId)
{
   //...do stuff with sessionId here
}

to:

EmailValidatedFunction()
{
   string sessionId = Request["sessionId"];
   //...do stuff with sessionId here
}

Answer 4

If you can, you need to make your sessionId URL safe. The sessionId is Base64 encoded, and there are three URL problem characters in Base64, "/", "+" and "=". Use the following to encode your sessionId when creating your link:

    public string ToUrlSafeBase64String(string Base64String)
    {
        // avoid any slashes, plus signs or equal signs
        // the following makes this base64 string url safe
        Base64String = Base64String.Replace("/", "_");
        Base64String = Base64String.Replace("+", "-");
        return Base64String.Replace("=", String.Empty);
    }

Then, use the following to re-create the original Base64 encoded string:

    public string FromUrlSafeBase64String(string Base64String)
    {
        // add back any slashes, plus signs or equal signs
        // the following makes this url safe string a base64 string
        Base64String = Base64String.Replace("_", "/");
        Base64String = Base64String.Replace( "-", "+");
        return Base64String.PadRight(Base64String.Length + (4 - Base64String.Length % 4) % 4, '=');
    }