All the time getting WebResource.axd?d=… errors

Question

I have an ASP.NET C# application and I am getting different errors all the time, like the one you can see below. Does anyone know how to fix that? Thank you.

Page: http://www.sitename.com/WebResource.axd?d=OYuYekAZWSmOdOaJyDRqKg2&t=634022222718906250
Message: This is an invalid webresource request.
Source: System.Web
Inner Exception:
Stack Trace: at System.Web.Handlers.AssemblyResourceLoader.System.Web.IHttpHandler.ProcessRequest(HttpContext context)
             at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
             at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Answer 1

Additionally to Andras thorough (and impressive from a phone:) answer, there was a bug in IE8 (patched already, but some may still have it in the wild) that use to cause a similar error. Although in that case the request came with garbage at the end, which does not seem to be your case, but it may give you a different thing to look at. Here's a question on SO that talks about it

Invalid Webresource.axd parameters being generated

Answer 2

I can think of three causes, only one of which actually point to a real error as such:

1. Somebody is trying to exploit a security hole in asp.net (a patch here) where you can get one of the axd handlers to serve up any content on the web server if you can figure out the encryption key. It is unlikely, but its possible. In this case, you don't have to do anything, except make sure that you have that fix applied.

2. (This is something I have observed on a site that I just finished) The scenario is where an existing site has been replaced or where the web server has been changed from what it was previously. If you have a site that is public and on Google, say, people might often view 'cached' page if they're trying to get to old content or indeed if the current page is not what they expect (perhaps an error or indeed just different). The problem being that if the site uses webresource.axd, that page will have a reference to it. The browser opens the cached html and then makes the request. If the site has been changed or is a replacement then the old axd links might not be valid any more and will cause an error.

   If this is an mvc site you might no longer be using resources rendered by the axds, in which case you could consider removing them from the site by editing the web config and adding 'remove' entries for them in the handlers section of system.webserver. Then the requests will yield a 404 and no longer will you get errors. Equally if the site does use axds legitimately, but you can't repro the errors yourself by browsing it, then you probably don't have anything to worry about.

3. the site runs in a web farm and each machine therefore needs to have the same machine key, this is the one actually needs attention if it is the case. I left it till last, tho, because looking at your other questions I'm assuming a web farm is not involved :)

I would have liked to format this answer better but I am on my phone, apologies!