title: IIS7.5 ASP.NET MVC users hitting strange URLs: /(F(1xe9eXIxPz
body: <p>We are getting reports from a small number of users that they are ending up on very strange paths in our web app, of the form:</p>
  
  <pre><code>https://www.example.com/(F(1xe9eXIxPzMALrZu6xd_6LBxDDlJI3lH2lkSvREZZKCfPBH20SF5EcNql6uXvyBVLgiNZshp9vXxaEzuLa5zm8c4ruux6gqu3B90eXGNmKDypu-wKR4OW_GwQctfjCdoxFYcDlLwglfE6rICL3JGkxtq4jgxggiQgJopKZGzLJ_PF2lHY7NqXya8eDshkP9o8QFDad47U54TMsxEwKCki2xPV9d9VxxjmDhNg7aQb38X_OTxHtf9I7AxiccanJf4m0bo0ceEJ70Mv20XYaMSlA2))/some/path
  </code></pre>
  
  <p>(Note: i've changed random chars in that in case its some kind of security leak, so don't bother trying to decode it - although if doing so might be helpful, please tell me what i'm looking for so I can do it on the real URL).</p>
  
  <p>This causes a 400 in IIS, but IIS doesn't log it, so I have no idea of the referrer etc.</p>
  
  <p>From what our users describe, its being caused at this step:</p>
  
  <pre><code>return Redirect("/some/path");
  </code></pre>
  
  <p>(which is in an ASP.NET MVC 2 Controller Action).</p>
  
  <p>The site running on IIS 7.5 under SSL.</p>
  
  <p>Any ideas? I've never seen anything like this :s</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I also have ISAPI rewrite installed, with the following <code>.htaccess</code>:</p>
  
  <pre><code>RewriteEngine on
  AllowOverride All
  
  # Ensure that all traffic on the live domain is enforced as HTTPS
  RewriteCond %{HTTP:Host} (.*)
  RewriteCond %{HTTPS} off
  RewriteCond %{REQUEST_URI} (.*)
  RewriteRule .? https://%1%2 [R,L]
  </code></pre>