IIS: Request with unknown content-type denied

iisiis-7iis-7.5mime-type

I have an IIS7.5 box running an asp.net mvc 3 application. The application receives binary POST requests and returns a binary answer. To distinguish this binary data from all other packets I setup my own mime-type (let's call it application/my.binary.data) that I use together with the Content-Type header.

The IIS-server does not seem to like my own mime-type and rejects the packet with a 400 Bad Request. If I change the mime-type to application/octet-stream it gets through IIS and I get an answer from my application.

How do I set IIS to allow my own mime-type for requests?

Request packet

POST http://my.local.domain/Page  HTTP/1.1
Host: my.local.domain
Content-Length: 33
Content-Type: application/my.binary.data
Cache-Control: no-cache

..............p.00000000000000...

Response packet:

HTTP/1.1 400 Bad Request
Cache-Control: private
Content-Type: text/html
Server: Microsoft-IIS/7.5
X-AspNetMvc-Version: 3.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 06 Jul 2011 08:11:27 GMT
Content-Length: 11

Bad Request

Best Answer

I was finally able to fix the problem by following the following guide at http://www.donnfelker.com/aspnet-mvc-iis7-and-bad-request/.

I added the following code to my web.config

<system.webServer>
  <httpErrors errorMode=”Detailed” />
</system.webserver>

Related Solutions

Iis – How to remove IIS/ASP.NET Response Headers

Your security department wants you to do this to make the server type harder to identify. This may lessen the barrage of automated hacking tools and make it more difficult for people to break into the server.

Within IIS, open the web site properties, then go to the HTTP Headers tab. Most of the X- headers can be found and removed here. This can be done for individual sites, or for the entire server (modify the properties for the Web Sites object in the tree).

For the Server header, on IIS6 you can use Microsoft's URLScan tool to remote that. Port 80 Software also makes a product called ServerMask that will take care of that, and a lot more, for you.

For IIS7 (and higher), you can use the URL Rewrite Module to rewrite the server header or blank it's value. In web.config (at a site or the server as a whole), add this content after the URL Rewrite Module has been installed:

<rewrite>    
  <outboundRules rewriteBeforeCache="true">
    <rule name="Remove Server header">
      <match serverVariable="RESPONSE_Server" pattern=".+" />
      <action type="Rewrite" value="" />
    </rule>
  </outboundRules>
</rewrite>

You can put a custom value into the rewrite action if you'd like. This sample sourced from this article which also has other great information.

For the MVC header, in Global.asax:

MvcHandler.DisableMvcResponseHeader = true;

Edited 11-12-2019 to update the IIS7 info since the TechNet blog link was no longer valid.

IIS7 rejecting POST requests with 400 error

You could check the HTTPERR log on that server. Maybe this blog post contains a hint how to solve the problem:

ASMX POST request fails with HTTP 400 erro when content-length size increases

First stop was to look at HTTPERR log on IIS box, Invalid verb error was report in it:
2009-03-09 21:30:53 10.1.48.56 42676 10.1.48.53 80 HTTP/0.0 Invalid - 400 - Verb - 

Related Topic