We're working on hardening our SharePoint server, and STIG V-76825 IISW-SI-000229 mandates that "Double encoded URL requests must be prohibited by any IIS 8.5 website". Basically, editing the Request Filtering feature settings in IIS and unchecking the Allow double escaping checkbox.

Is this going to limit any SharePoint operations, considering the source parameter is escaped and used in a lot of operations? Or things like document names?

I've done a little testing, but I don't have a way to test every possible SharePoint url, and I haven't found a definitive answer searching the internet yet. If we need to leave it checked, I have to have some good documentation as to why.

  • Your best bet is to open a support case so you can get an official word from the product group. This will also help you if they say it isn't supported. – Trevor Seward Apr 30 '19 at 3:54
  • That's a great idea! I'll just forward them the entire guides on securing an IIS server link and securing all the websites link, and see which ones they say to ignore. Since it's been a few years since SharePoint 2016 was released, I'm sure they've got a list by now. – Marc Apr 30 '19 at 13:03
  • Did you get a response to this from your MS support case? – Noemi Jun 10 '19 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.