IIS7 – How to update the alias after site creation

I think you are misunderstanding pass through authentication. If pass through authentication is enabled, one of 2 things will happen:

• for anonymous authentication, the user ID specified for anonymous access needs access to the physical path for the files. (By default, this is the built in IUSR account, but can be configured in the Edit action for anonymous auth)

• if you have authentication enabled, then the authenticated user credentials need access to the physical path of the files. The application pool identity will also need read-only access to the files.

After searching for more combinations of IIS and plus, it appears that IIS7[.5] is set up to reject URLs with a plus sign by default out of some fear of the use of that character; that symbol is still allowed in the querystring, though. The solution is to alter the requestFiltering attribute default on <system><webServer><security><requestFiltering> to allow doubly-encoded characters with a command line call (ultimately modifying your ASP.NET web.config):

%windir%\system32\inetsrv\appcmd set config "Default Web Site" -section:system.webServer/security/requestFiltering -allowDoubleEscaping:true

This may be a bit more dangerous than one prefers to be with their web site, but there didn't appear to be a way to be more specific than a blanket allow. The warnings were regarding the mismatching that could occur between using a plus in a URL and its typical translation as a space. It looks like the only other alternative is to stop using plus characters in your URLs at all.