title: HTTP Module intercept requests and breaks custom errors configuration
body: <p>I have an ASP.NET MVC 5 web application which runs locally on IIS 8.5 and after deployment, on Azure Websites - on both cases, the behavior that will be later described is the same.</p>
  
  <p>I configured in the web.config the following custom errors page management (it covers all my cases of custom errors and it has been tested and it's working great):   </p>
  
  <pre><code>&lt;system.webServer&gt;
    &lt;httpErrors errorMode="Custom" existingResponse="Replace"&gt;
      &lt;clear /&gt;
      &lt;error statusCode="400" responseMode="ExecuteURL" path="/App/Error"/&gt;
      &lt;error statusCode="403" responseMode="ExecuteURL" path="/App/Error/Forbidden" /&gt;
      &lt;error statusCode="404" responseMode="ExecuteURL" path="/App/Error/NotFound" /&gt;
      &lt;error statusCode="500" responseMode="ExecuteURL" path="/App/Error" /&gt;
    &lt;/httpErrors&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>Also, I have an HTTP Module configured in the same web.config like this:   </p>
  
  <pre><code>&lt;system.webServer&gt;
  &lt;modules&gt;
    &lt;add name="ImageProcessorModule" type="ImageProcessor.Web.HttpModules.ImageProcessingModule, ImageProcessor.Web" /&gt;
   &lt;/modules&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>The issue that I have is like this: if I'm making a request to a strange URL like <code>.../c&lt;</code>, the application executes the 500 custom error path as instructed in the web.config file. 
  But, if I'm making a request to a stranger URL (to simulate an html tag) like <code>.../&lt;c</code>, though the resulted error is 500, the custom error is not executed anymore, because accordingly to the detailed error, the HTTP Module intercept the call and "decides" to just show a YSOD... </p>
  
  <p>The message that I get is:</p>
  
  <blockquote>
    <p>A potentially dangerous Request.RawUrl value was detected from the client (="/App/
  </blockquote>
  
  <p>And is easy to see that this is caused by the webmodule because of the stacktrace:</p>
  
  <blockquote>
    <p>[HttpRequestValidationException (0x80004005): A potentially dangerous Request.RawUrl value was detected from the client (="/App/d__10.MoveNext() +201
           System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +144   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +84
           System.Web.TaskAsyncHelper.EndTask(IAsyncResult ar) +98
                           System.Web.AsyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +434
           System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously) +288</p>
  </blockquote>
  
  <p>If I'm commenting out the Image Processor Module from the web.config, everything runs as expected.</p>
  
  <p>Why in this case, the custom error path doesn't get executed?</p>
  
  <p>Thank you for your time and answers.</p>