2

Update - It seems the Cisco Netscaler is causing the problem. Now I have server access (and bypassed the NLB by going direct to the WFE) then everything is working again

Solution - It seems Cisco Netscaler had "Intelligent Filtering" enabled which detected every HTTP POST which contained HTML in the body as a Script Injection Attack and blocked it .. sigh

Weird issue I am facing.

I have a SharePoint 2013 SP1 Enterprise farm running with three load balanced Web Servers (through a Cisco Netscaler). We are using Sticky Sessions (Cookie Based sessions falling back to IP based if cookies are unavailable)

The strange behaviour is that everytime I try to modify a Rich Text Field and hit "save" then I am redirected to the site home page. If I don't modify the Rich Text Field then it works fine (and I can happily edit any other properties). There is nothing in Fiddler showing except an immediate 302 redirect to "/".

This happens with both Publishing Pages as well as custom lists (which have Rich Text Fields).

  • This happens with "out of the box" sites with no customisations applied
  • We are using both FBA and Windows Authentication with the standard Sign-In Pages
  • The error is observed with both FBA and Windows users
  • This is observed in all Site Collections

We have numerous DEV / TEST boxes running the same setup, but none of them are displaying this behaviour.

Does anyone have any idea why this is happening?

Edit - I have since tried removing FBA (so it is Windows Auth only) and have removed two of the Web Servers (so we only have a single Web Server in the NLB). Still having exactly the same error

Further Edit - I have checked the ULS logs. Apart from a load of "Search not found" errors (I am not running a Search Service on this farm) there is nothing about any kind of errors. Fiddler2 just shows an immediate 302 response from the HTTPS POST event.

  • Cisco Netscaler intelligent filtering fail .. main question updated – Martin Hatch Mar 12 '14 at 12:30
  • Glad you got it working! Please submit your solution as an answer and mark it so as to remove this question from the unanswered questions list. – Aron Foster Mar 18 '14 at 22:46
0

It seems Cisco Netscaler had "Intelligent Filtering" enabled which detected every HTTP POST which contained HTML in the body as a Script Injection Attack and blocked it.

Removing this filtering resolved the problem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.