Fix max URL and query string length with web.config and IIS
Tags: dotnet, iis, configuration
Published: 2021-01-13 09:19:50

---
title: Fix max URL and query string length with web.config and IIS
published: true
description: Learn how to configure IIS to allow both long URLs as well as long query strings. Without it, your web server may return 404s to your users.
tags: dotnet, iis, configuration
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/p935a7fg9x3mh0tfffsl.png
canonical_url: https://blog.elmah.io/fix-max-url-and-query-string-length-with-web-config-and-iis/
---

I had a problem the other day that I believe qualifies as a blog post. An elmah.io user reported that refreshing the organization overview would generate a 404. After debugging the problem, I found out that the URL generated by that page can be too long. This post is an explanation of the error and how to fix it.

## The error

When looking at the error generated on localhost, I saw the following:

![](https://blog.elmah.io/content/images/2019/09/long-url-404-error.png)

And in text:

> **HTTP Error 404.15 - Not Found**
> The request filtering module is configured to deny a request where the query string is too long

When looking at the **Requested URL** field at the bottom of the screenshot, it is clear that the URL is long. IIS enforces some limitations in the number of characters accepted as part of the query string. As suggested by the error message, this can be fixed by modifying the `maxQueryString` settings in the `web.config` file. Let's quickly recap the structure of an URL:

|Protocol|Domain|Path|Query string|Fragment|
|---|---|---|---|--|
|https://|app.elmah.io|/errorlog/search/|?logId=42|#overviewTab|

The error above is on the query string part, but there are other limitations as well. For the **Path** part, IIS also limits the number of allowed characters. This setting is named `maxUrl`, which doesn't make a lot of sense (IMO) when looking at the breakdown above. Both `maxQueryString` and `maxUrl` have default values, as shown below:

||Protocol|Domain|Path|Query string|Fragment|
|---|---|---|---|---|--|
||https://|app.elmah.io|/errorlog/search/|?logId=42|#overviewTab|
|**Max length**|||`4096`|`2048`||

The default values are quite decent and cover most scenarios. To support a very long query string (or path) as illustrated by this error, there's an easy fix.

## The fix

As you probably already guessed, the fix is to change the `maxQueryString` setting (or `maxUrl` if the problem is in the path). To do so, modify the `security` element in the `web.config` file:

```xml
<configuration>
  ...
  <system.webServer>
    ...
    <security>
      <requestFiltering>
        <requestLimits maxQueryString="8192" />
      </requestFiltering>
    </security>
  </system.webServer>
</configuration>
```

In this example I have quadrupled the allowed number of characters in the query string.

For older websites, you need to change the setting as part of the `system.web` element:

```xml
<configuration>
  ...
  <system.web>
    ...
    <httpRuntime ... maxQueryStringLength="8192" />
  </system.web>
</configuration>
```

> Notice that when using the `httpRuntime` element to configure max length, different default values exist. Most modern websites don't need to worry about this, though.

## Would your users appreciate fewer errors?

elmah.io is the easy error logging and uptime monitoring service for .NET. Take back control of your errors with support for all .NET web and logging frameworks.

➡️ [Error Monitoring for .NET Web Applications](https://elmah.io/?utm_source=devto&utm_medium=social&utm_campaign=devtoposts) ⬅️

This article first appeared on the elmah.io blog at https://blog.elmah.io/fix-max-url-and-query-string-length-with-web-config-and-iis/