requestFiltering

Request Filtering is a security feature of Internet Information Services (IIS) that blocks or restricts HTTP requests based on configurable rules. Implemented as a module in IIS, it inspects components of incoming requests, such as the URL, query string, headers, and, when enabled, the request body, and rejects those that violate defined criteria.

Rules are organized into categories that include file name extensions, hidden segments, and general request limits. File name extensions can be denied or implicitly allowed, preventing access to resources with certain extensions (for example, executable or script extensions). Hidden segments restrict specific path segments from appearing in a URL, aiding in preventing access to sensitive directories. Request limits control the size and content of requests, with settings such as maxAllowedContentLength, maxUrl, and maxQueryString. The module also supports encoding considerations, including allowDoubleEscaping and allowHighBitCharacters, to govern how encoded requests are processed.

Configuration and scope are flexible: Request Filtering can be applied at the server, site, or application level through IIS Manager or by editing configuration files. In web.config and applicationHost.config, it is expressed under system.webServer/requestFiltering, with elements such as fileExtensions, hiddenSegments, and requestLimits. The feature includes default rules and can be extended with custom rules to align with security policies.

Historically, Request Filtering is part of IIS 7 and later, introduced to provide a centralized mechanism for filtering requests in the integrated pipeline, and it serves to mitigate exposure to common attack vectors such as inappropriate file access, path traversal, and overly large or malformed requests.