Whitespace (any uri escapable char) in virtual path root results in NoRouteFound in an WebApi/Owin setup

[adzhiljano]

Hello,

First of all, thank you very much for the Asp.Net and Katana!!!

I'm not entirely sure if this is an issue with WebApi or Katana or with the integration bits.

The environment is the following:

Packages (should be latest possible versions):

  <package id="Microsoft.AspNet.WebApi" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebApi.Client" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebApi.Core" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebApi.Cors" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebApi.Owin" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.AspNet.WebApi.WebHost" version="5.2.6" targetFramework="net461" />
  <package id="Microsoft.Owin" version="4.0.0" targetFramework="net461" />
  <package id="Microsoft.Owin.Cors" version="4.0.0" targetFramework="net461" />
  <package id="Microsoft.Owin.Host.SystemWeb" version="4.0.0" targetFramework="net461" />
  <package id="Microsoft.Owin.Security" version="3.1.0" targetFramework="net461" />
  <package id="Microsoft.Owin.Security.OAuth" version="3.1.0" targetFramework="net461" />
  <package id="Owin" version="1.0" targetFramework="net461" />

Hosting: IIS 10
OS: Win 10
Site/App: 'Virtual' application under the Default Web Site (localhost:80) with the name test api

But can be reproduced with the following minimal setup:

public void Configuration(IAppBuilder app)
{
	HttpConfiguration config = new HttpConfiguration();

	config.MapHttpAttributeRoutes();

	app.UseWebApi(config);
}

When I try to send a request to http://localhost/test%20api/ I get a 404 and this is what I managed to trace:

1. The Uri related contents of the OwinRrequest (got it from a fake first middleware in the pipeline)
   
   

2. The processing gets to a point where the the virtual path root is needed
   

   AspNetWebStack/src/System.Web.Http/HttpRouteCollection.cs

   Line 82 in e0f1f13

   string virtualPathRoot = GetVirtualPathRoot(request.GetRequestContext());

and this is the current context:

3. Further a RoutingContext is needed
   

   AspNetWebStack/src/System.Web.Http/Routing/HttpRoute.cs

   Line 154 in e0f1f13

   private static RoutingContext CreateRoutingContext(string virtualPathRoot, HttpRequestMessage request)

and this is where the actual problem can be seen:

It's trying to do
"/test api/".StartsWith("/test%20api", StringComparison.Ordinal) which results in a return RoutingContext.Invalid(); and then in a NoRouteFound.

I'll just share some additional info and my toughts:

An escapable character in the virtual path in a pure (no Owin) WebApi setup is NOT a problem, it works as expected (I haven't debugged it though).

Please, keep in mind that I haven't gone that deep into the source codes so I might be missing something!

The way the virtual path root is retrieved maybe is the problem:

AspNetWebStack/src/System.Web.Http.Owin/OwinHttpRequestContext.cs

Line 185 in e0f1f13

string requestPathBase = _context.Request.PathBase.ToString();

the PathBase.ToString() is actually ToUriComponent() which escapes the string.

https://github.com/aspnet/AspNetKatana/blob/e2b18ec84ceab7ffa29d80d89429c9988ab40144/src/Microsoft.Owin/PathString.cs#L60

and later on the HttpRoute.CreateRoutingContext() is doing (notice the UriFormat.Unescaped)

AspNetWebStack/src/System.Web.Http/Routing/HttpRoute.cs

Line 157 in e0f1f13

string requestPath = "/" + request.RequestUri.GetComponents(UriComponents.Path, UriFormat.Unescaped);

and then those two are compared.

The only workaround that I found out was to use a custom HttpRouteCollection with an override of the
public virtual IHttpRouteData GetRouteData(HttpRequestMessage request) method so that I can unescape the virtual path root. Is there another way of doing this?

Thank you!

[dougbu]

@adzhiljano you've described a relatively low-level behaviour of the ASP.NET and Owin (Katana) code but not the user scenario in which an error occurs. That is, you've illustrated how PathBase and Path are retrieved and one place where the two are compared. But, what is the scenario, how does it fail e.g. are there unexpected 404s, and what changes when the app is self-hosted (not using Katana) or running in IIS or IIS Express?

That said, comparing escaped and unescaped values seems incorrect. Either Katana behaves differently from other ASP.NET hosts or another property should be used to ensure ASP.NET compares consistent (escaped or unescaped) values.

@Tratcher any other thoughts?

[adzhiljano]

Hey @dougbu,
The scenario is that whatever request is sent to http://localhost/test%20api/**/* (arbitrary endpoint) the result will be 404 - it's basically app.Don'tUseWebApi(config); middleware. Other middlewares work fine. There are only unexpected 404s for each and every endpoint one thought he registered.

I'm not sure what you mean by

self-hosted (not using Katana)

I haven't tried it with Microsoft.Owin.SelfHost, but as I mentioned I tried it with

An escapable character in the virtual path in a pure (no Owin) WebApi setup is NOT a problem, it works as expected (I haven't debugged it though).

by which I meant running WebApi with no Owin (GlobalConfiguration.Configure(WebApiConfig.Register);) setup on IIS/IIS Express and it was working as expected - I was able to hit all endpoints.

And I'm pretty sure that the host is irrelevant in this case

You can reproduce the issue:

• create a new Web proj,
• make a virtual directory with a whitespace in it's name
• add an Owin Startup class with minimal setup:

public void Configuration(IAppBuilder app)
{
	HttpConfiguration config = new HttpConfiguration();

	config.MapHttpAttributeRoutes();

	app.UseWebApi(config);
}

• add Controllers
• try hitting any endpoint

[dougbu]

I'm pretty sure that the host is irrelevant in this case

Why are you sure of that? The host provides the PathBase information. I'm trying to understand if hosts other than Katana are consistent.

[adzhiljano]

I got a bit confused there. When I was refering to the host, I meant an Owin host and this is why I said the host should be irrelevant. I tried different ASP.NET hosts and Owin hosts (repo) and this is the summary for the url http://localhost/test%20api/values:

• IIS/IIS Express (Microsoft.AspNet.WebApi.WebHost) -> Working (200)
• HttpSelfHostServer (Microsoft.AspNet.WebApi.SelfHost) -> Working (200)
• Owin (Microsoft.AspNet.WebApi.Owin):
  • IIS/IIS Express (Microsoft.Owin.Host.SystemWeb) -> Not Working (404)
  • HttpListener (Microsoft.Owin.SelfHost) -> Not Working (404)
  • HttpListener (Microsoft.AspNet.WebApi.OwinSelfHost) -> Not Working (404)

[Tratcher]

Side note: don't mix Microsoft.Owin 3.1 and 4.0 components, upgrade everything.

I agree this looks like a format bug in the WebApi's Owin integration.