title: HttpActionContext.Request.RequestUri.Query returns empty if URL path has %23 (# hash) sign
body: <p>I am using MVC4 Web Api Controller and part of my URL contains a %23 ("#").  The client code uses the UrlEncode to make the request.  The service code calls HttpUtility.UrlDecode(HttpActionContext.Request.RequestUri.Query) to get the query string.  I can get this running correctly on my local environment; however, the version deployed on the server returns back empty string on the HttpUtility.UrlDecode(HttpActionContext.Request.RequestUri.Query) call.  What do I need to do to make it work on the server?</p>
  
  <p>EDIT: some more info.  Same server code, same URL path but works on local machine but not on the server machine.  For simplicity I use the chrome browser to make the api call.  the URL has been encoded as such <a href="http://example.com/api/order/1059%23111?name=xyz%fid=61" rel="nofollow">http://example.com/api/order/1059%23111?name=xyz%fid=61</a>
  This is to get order 1059#111.</p>
  
  <p>When I call localhost:64986/api/order/1059%23111?name=xyz%fid=61, it works, but when I call <a href="http://example.com/api/order/1059%23111?name=xyz%fid=61" rel="nofollow">http://example.com/api/order/1059%23111?name=xyz%fid=61</a> from the browser, I get an error due to the query string is empty.  On the server in the OnAuthorization call in the class I extend from AuthroizationFilter and I need to parse the query string and I use HttpUtility.ParseQueryString(actionContext.Request.RequestUri.Query) to get the query name-value pair.  It appears when hitting the server, the actionContext.Request.RequestUri.Query returns "" but on my local server it returns "?name=xyz%fid=61".</p>
  
  <p>Below is a code snip in the api</p>
  
  <pre><code>    public class MyAuthorizeAttribute : AuthorizationFilterAttribute, IExceptionFilter
  {
  
      public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          if (Thread.CurrentPrincipal.Identity.IsAuthenticated)
              return;
          var authHeader = actionContext.Request.Headers.Authorization;
  
          string qstr = HttpUtility.UrlDecode(actionContext.Request.RequestUri.Query);
          NameValueCollection query = HttpUtility.ParseQueryString(qstr);
          if (query.Count &gt; 0)
          {
            ...process validation
          }
          else
            actionContext.Response = actionContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Unauthorized user.");
       }
  }
  </code></pre>
  
  <p>If the API call is to my local web api (localhost:64986/api/order/1059%23111?name=xyz%fid=61), then it enters validation if, if call is to the web api on the server (<a href="http://example.com/api/order/1059%23111?name=xyz%fid=61" rel="nofollow">http://example.com/api/order/1059%23111?name=xyz%fid=61</a>), it went into else and returns unauthorized user.  What would cause the different in local vs production server?  IIS or anything need to be added to web.config?</p>