Duplicate querystring pairs

Repro steps.

• Deploy a node-based app to App Services
• Enable web server logging
• Hit a page that contains a querystring variable, such as http://mysite/?foo=bar
• Check the web server logs and notice that the entry for the hit contains duplicated querystring values, eg [date] [servername] GET / foo=bar&foo=bar&X-ARR-LOG-ID=[guid]

Project structures.

I have duplicated this in two different node apps. One app uses a custom iisnode.yml and web.config but they are not too far off from the defaults. The other app does not use a custom iisnode.yml or web.config but instead has them generated by the kudu deployment command. The first app uses node 7.7.4 and the second uses 8.0.0.

I believe the URL logged in the web server logs comes straight from IIS and is not affected at all by the node app itself. Therefore I think the issue is either in the IIS configuration further up the chain or some other process that I’m unaware of.

Mention any other details that might be useful.

I also happen to have a .NET application deployed to App Services as well that does not exhibit the issue.

I discovered this because of an issue with the querystring being too long and hitting requestFiltering limits. Despite the original querystring being under the limit, the duplicated value put it over and triggered IIS filtering those requests into 404.15.

[davidebbo]

Changing it to PATH_INFO. Based on some more testing, it doesn’t seem to break anything. Though it still comes with a risk since it’s been like that for years. We’ll see.

[davidebbo]

Note that this change is now fully deployed. Please verify that it all works with no workarounds now.