ASP MVC (attribute) routing with plus chars

Question

I have the following route:

[Route("konto/validera-epost/{email}/{hash}")]
public ActionResult ValidateEmail(string email, string hash)

This works great util someone uses an email with an "+" in it, like:

http://localhost:53529/konto/validera-epost/niels%2btest1%40bosmainteractive.se/4eac5247b9e6c9ae2a020957a54dd644

Just getting an empty page as a result.

Answer 1

This is most likely due to a security setting in IIS preventing + in url's.

To resolve (or override/disable), either change it in the IIS, or in the web.config like below:

<system.webServer>
  <security>
    <requestFiltering allowDoubleEscaping="true" />
  </security>
</system.webServer>

References:
- http://www.ifinity.com.au/Blog/EntryId/60/404-Error-in-IIS-7-when-using-a-Url-with-a-plus-sign-in-the-path
- https://serverfault.com/questions/76013/iis6-vs-iis7-and-iis7-5-handling-urls-with-plus-sign-in-base-not-querystr

Note: I've seen some security concerns about enabling this option. I'd recommend reading up on this feature more before using in a live environment.

Edit based on @Ryan's comment:

[..] you can apply this at the action level with an attribute [ValidateInput(false)]