Reasons not to increase maxQueryStringLength?

Question

From time to time I find myself in a situation where I need to send rather large ajax GET requests from my java script client to my asp.net-mvc application (running IIS 7). If the URL is longer than 2048 characters, you get a default exception. A simple solution to this was to increase maxQueryStringLength using web.config.

My question is, are there any good reasons why you shouldn't follow this path, and if it is actually considered a hack? I read something about different browsers limiting the number of characters in the address field, but if you use only ajax, could this be a problem worth thinking about?

I know that in many cases you should use POST instead of passing large amounts of data to the request, but sometimes this is not an option. For example, when your URL returns a file to be downloaded by the user.

One specific example of where I had to increase maxQueryStringLength is: A user requests some locations on a map bounded by a polygon. If you want to send this polygon to a URL, you can easily exceed the maximum length of the URL.

Answer 1

By the way, this is a security measure ...

Another point is that not all clients (i.e. browsers) support lengths above 2048.

A detailed explanation can be found at fooobar.com/questions/112 / ...

IF you are in a situation within the network and have control over clients (browsers + versions) and the server. THEN, maybe this is normal ... for a wild application, I would highly recommend using POST instead.

Answer 2

maxQueryStringLength (probably) is used as protection against DDoS / buffer attacks.

Answer 3

I don’t see how it would immediately jeopardize security. Why should 2047 be safe and 2049 unsafe? IIS and ASP.NET, of course, are programmed to not overload their memory buffers, because this will be a security issue. Managed code is also immune to buffer overflows.

Since most applications do not need such large URLs, in my opinion, 2048 is a reasonable default.

You can probably increase the limit without consequences.