ASP.NET IIS Software Engineering

UrlRewriting, .NET 2.0 SP1 and Search Engines

Having been caught out by this issue once again this weekend, I thought I’d better blog about it so I don’t scratch my head searching around again for a third time!

If you’ve been getting some wierd “Cannot use a leading .. to exit above the top directory.” exceptions occuring on your site (you *do* log those, don’t you?), that you can’t reproduce in the browser, stay tuned. The issue crops up with URL Rewriting in .NET 2 SP1 – and the reason I’ve hit this again is when our production server was upgraded to .NET 3.5… evidentally this installed the service pack as a side-effect. So much for our patching strategy.

Anyway, this triggered a flow of errors for “Cannot use a leading .. to exit above the top directory.”, all stemming back to a call to System.Web.Util.UrlPath.ReduceVirtualPath – but apparently only for particular visitors to the site – specifically search engine bots, including Googlebot. The issue occurs, as far as I understand, because .NET is specifically targeting code to particular browsers – in this case, I believe the issue results because it knows the user-agent doesn’t support cookies, and is therefore trying to work accordingly.

There are two workarounds out there.

1. In your web.config,add the following:

<authentication mode="Forms">
            <forms cookieless="UseCookies" />

This will bypass the issue entirely – by telling .NET to always use cookies for authentication – but if you require forms authentication to work in a cookie-less scenario,then this won’t work. So, on to option number 2

2. Create a .browser file to match the user agents that are causing the issue. Check out this article that describes how.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.