locked
Case Sensitivity RRS feed

  • Question

  • User1400406851 posted

    Can you explain under what conditions (special configuration/default behavior/etc) and what is the scope of case-insensitivity in IIS?  Does it apply only to the "path" of the URL (i.e. the part that corresponds to /a/file/on/disk) or does it also apply to HTTP parameters in the Query-string and/or POST data?  What about HTTP Cookies - are their names case-insensitive as well?  Is the behavior consistent across various extant versions of IIS (5/6/7/other?) or has it changed in various releases?  Links to documentation as well as explanations are all welcomed.

    Thanks

    Monday, March 8, 2010 6:15 AM

Answers

  • User178678205 posted

    I apologize if my previous responses were poorly worded or if I have provided you with incorrect information.  My experience with getting query string info is mainly from writing native IIS modules/handlers, in which case you get the request query as it was typed and have the ability to parse it and make the decision whether case is important or not. I am not as familiar with using managed code to get query information - and it appears that Request.QueryString() is case-insensitive. 

    However, using ASP (and Request.QueryString()) is not the only way to get query information and use it on IIS.  For example, if you use PHP and the aforementioned _GET("name") on IIS it will still only get case-sensitive matches (i.e. queries with "name" and not "Name" or "NAME"). This is what I mean about not being IIS-specific - it depends on the code of the language you are using and the methods it uses to get request information.  It is perhaps ASP-specific that you will always get case-insensitive parameter name matching (again, I'm not an expert in this area and don't know if there are alternative methods other than Request.QueryString() that would allow you to be case sensitive).

    If it is important that you have case-sensitivity for your code, and you wish to use ASP, please consider an approach such as that noted here: http://msdn.microsoft.com/en-us/magazine/cc163462.aspx which details how one can define parameter names in an xml file and provides code samples for a handler that can enforce case-sensitivity (and other validation) for those parameters. 

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Tuesday, March 9, 2010 7:00 PM

All replies

  • User178678205 posted

    Generally speaking IIS will be case-insensitive. The casing for URLs should work consistently regardless of casing, as should disk file paths for virtual directories.  Items in query strings, etc. may be handled by an application (i.e. by code for the page being requested), and in these cases it will depend on what the application expects (it's not IIS-specific). 

    One of the few places where casing may be significant is for page ranking/analytics (also not an IIS item).  This is something you can use IIS's URL Rewrite extension to correct to improve your page ranking/analytics.  There's some information on this here: http://blogs.iis.net/ruslany/archive/2009/04/08/10-url-rewriting-tips-and-tricks.aspx under "Enforce Lower Case URLs", relevant explanation copied below for reference:

    "A problem similar to the trailing slash problem may happen when somebody links to your web page by using different casing, e.g. http://ruslany.net/2008/07/IISNET-Uses-Url-Rewrite-Module/ vs. http://ruslany.net/2008/07/iisnet-uses-url-rewrite-module/. In this case again the search crawlers will treat the same page as two different pages and two different statistics sets will show up in Web Analytics reports." 

    Monday, March 8, 2010 11:28 AM
  • User1400406851 posted

    Items in query strings, etc. may be handled by an application (i.e. by code for the page being requested), and in these cases it will depend on what the application expects (it's not IIS-specific). 

     

    Can you give more details on that point?  This is really the crux of my question - does IIS handle HTTP parameters (in query string or POST data) in a case-insensitive way?  If so, can you point me to the documentation?  If not, are there some very common cases in which case-insensitive parameters occur despite IIS, i.e. is it a default or common configuration for ASP.NET or some other framework commonly used with IIS, to handle parameters case-insensitively?

    Tuesday, March 9, 2010 1:10 AM
  • User178678205 posted

    I've been trying to find some documentation links, but also find it difficult.  Here's a couple of finer points I came accross:

    1. IIS treats URLs case-insensitively (I believe this is related to requirements in RFC docs) but browsers may treat URLs as case-sensitive when assigning cookies. You can read more about this here: http://social.msdn.microsoft.com/Forums/en-US/Geneva/thread/b5715cbe-6db0-4f59-a26e-f26d2c90ef26 or here: http://directoryprogramming.net/forums/permalink/6910/6916/ShowThread.aspx " the cookie path is treated as case sensitive by the browser, but IIS is generally very happy to treat a URL folder or virtual directory path as case-insensitive."

    2. There may be specific modules in IIS that will handle a specific thing with case sensitivity, like URL Rewrite or AllowVerbs in URLScan.  This is typically only in places where different casing is an issue (like when it causes page ranking problems).  Another place casing would be important in IIS is relating to config information (as this is stored in XML).

    3. As far as I know, IIS will just pass the query/post data as it was written, with no respect to casing, to what wants to look at it (i.e. that IIS handles this data in a case-insensitive way). I'm afraid I was not able to find a good link for documentation - but if you are running into a problem or can provide more specific information on what you are trying to accomplish, I may be able to give you a more specific reply. 

    Tuesday, March 9, 2010 11:26 AM
  • User1400406851 posted

     I am trying to figure out if IIS provides an interface to application code (C#/ASP/whatever) or whether the application-frameworks/languages themselves generally or sometimes treat parameters (whether Query-string i.e. "GET" parameters or POST parameters) in a case-insensitive way.

    To compare:

    In PHP running under Apache, the code:

    $_GET["age"]

    will retrieve the value of the "age" parameter when it's requested as "/file.php?age=12" but NOT if it's requested as "/file.php?AGE=12". That is, "AGE" and "age" are 2 totally unrelated HTTP parameters in this environment.  My question is, is this true in IIS environments as well?  I have reason to believe that at least sometimes parameters are treated case-insensitively, for example these 2 URLs appears to be understood the same way by  the server:

    http://www.scottgu.com/Details.aspx?albumid=2

    http://www.scottgu.com/Details.aspx?ALBUMID=2

    So I am wondering, is this behavior the "rule" i.e. this is the general way IIS behaves, and parameter names have no "case", or is this something specific that is happening in this application, but is not "normal" per se?

    Thanks

    P.S. The ASP example for what I mean would be:

    Request.QueryString("Q") 
    Does this retrieve the value of "?Q=foo" and "?q=foo" ? If so, is this documented? And is it ASP specific or true for any code that retrieves parameters from IIS. Again, a link to a doc is really helpful (specifically relating to the case-insensitive behavior).
     

    Tuesday, March 9, 2010 1:47 PM
  • User178678205 posted

    Short answer: this is something specific that is happening in the application 

    The case-insensitivity example you indicate is not that the parameters are treated case-insensitively by IIS, but rather that the .aspx application (Details.aspx) is handling the query information in a case insensitive way.  In the first example on Apache, it is the file.php code that is choosing to handle the parameter differently - so it would probably act exactly the same on IIS. 

    My understanding is that, basically, the user will send query information like "?AGE=12" or "?age=12" and IIS will not alter the casing.  An application that cares about query values will get the query from the request with the original casing: "AGE" or "age" and it is up to the code in the page to decide how to treat the parameters.  The .php page apparently has code which will treat parameters as different if they have different casing (it isn't checking for a case-insensitive "age", it is checking for specifically "age").  The .aspx page apparently has code which will treat query variables as the same, even with different casing (it is checking for a case-insensitive version of the "albumid" parameter).  This is not IIS specific - it relates to how the code in the requested page handles the parameters. 

    Tuesday, March 9, 2010 2:25 PM
  • User1400406851 posted

     

    The .aspx page apparently has code which will treat query variables as the same, even with different casing (it is checking for a case-insensitive version of the "albumid" parameter).  This is not IIS specific - it relates to how the code in the requested page handles the parameters. 

    Can you give example of code that might be doing this?  If I understand correctly, code like the following could produce this behavior:

    Request.QueryString("albumid") 
    This will retrieve the value of "albumid" or "ALBUMID" or "aLbUmId" etc in a query string.  If that is the case, then I would say this is NOT something specific in the application (it's using the generic programming interface to retrieve parameters) and it's then generally the IIS behavior, since most if not all applications are going to retrieve parameters in exactly the same way, and it's case-insensitive.  This seems to totally contradict what you said, or maybe I didn't understand you, which is why I ask.

    Tuesday, March 9, 2010 2:56 PM
  • User178678205 posted

    I apologize if my previous responses were poorly worded or if I have provided you with incorrect information.  My experience with getting query string info is mainly from writing native IIS modules/handlers, in which case you get the request query as it was typed and have the ability to parse it and make the decision whether case is important or not. I am not as familiar with using managed code to get query information - and it appears that Request.QueryString() is case-insensitive. 

    However, using ASP (and Request.QueryString()) is not the only way to get query information and use it on IIS.  For example, if you use PHP and the aforementioned _GET("name") on IIS it will still only get case-sensitive matches (i.e. queries with "name" and not "Name" or "NAME"). This is what I mean about not being IIS-specific - it depends on the code of the language you are using and the methods it uses to get request information.  It is perhaps ASP-specific that you will always get case-insensitive parameter name matching (again, I'm not an expert in this area and don't know if there are alternative methods other than Request.QueryString() that would allow you to be case sensitive).

    If it is important that you have case-sensitivity for your code, and you wish to use ASP, please consider an approach such as that noted here: http://msdn.microsoft.com/en-us/magazine/cc163462.aspx which details how one can define parameter names in an xml file and provides code samples for a handler that can enforce case-sensitivity (and other validation) for those parameters. 

    • Marked as answer by Anonymous Tuesday, September 28, 2021 12:00 AM
    Tuesday, March 9, 2010 7:00 PM