title: Due to the presence of characters known to be used in Cross Site Scripting attacks, access is forbidden
body: <p>Can anyone tell me where does following HTTP error message come from:</p>
  
  <p><em>Due to the presence of characters known to be used in Cross Site Scripting attacks, access is forbidden. This web site does not allow Urls which might include embedded HTML tags.</em> </p>
  
  <p>We're using dynamically generated URLs and in this specific case the URL contains the characters '&lt;' or '>'. We do URL encode the generated URL (so '%3C' appeary instead of '&lt;') but it doesn't help.</p>
  
  <p>Our setup is ASP.NET MVC / IIS 7.5 / IE8.</p>
  
  <p>It's strange but it looks like the error appears only on some machines. So it could be that the IE internet zone settings are playing a role.</p>