Why Am I getting: “A potentially dangerous Request.Path value was detected from the client (&).”?

Question

I don't understand why I am getting exception calling the action from my controller by typing the full url

It works fine calling from form or ajax post using jquery, it is not setup to accept only post, my last try, I just specify explicitly the HttpGet and setip the validation page = false in the web.config. I'm lost

this is the url I am passing: main/request/theprogram=xx&theaction=yyy&theobject=

exception: A potentially dangerous Request.Path value was detected from the client (&).

Answer 1

You are passing & as part of "path" portion of Uri which is very unusual and triggers the warning.

Most likely you want it to be part of "query" portion (*notice ? that separates query portion):

main/request/?theprogram=xx&theaction=yyy&theobject=

If you want parameters to be part of the path then it normal to not have names, but simply positioned values or use path-safe separator like ():

main/request/xx/yyy/
main/request/theprogram(xx)/theaction(yyy)/theobject()