request exceeds the configured maxQueryStringLength when using [Authorize]

Question

I have a MVC3 site in C#, I have a particular view being fed query parameters from a JavaScript function, the function redirects to the site via

window.location.href = "../ActionName?" + query_string;

query_string being the dynamic query parameters string built by the JavaScript function.

The reason for this weirdness is that sometimes the same function passes the URL to an ASP.Net webform due to it having to use the reportviewer control, the alternate action is to save some parameters in this case it passes to the view. (Can elaborate more if that does not make sense)

The whole thing works fine until I introduce [Authorize] to the action method. Breaks if it is in place, works fine without, and [Authorize] works fine on all the other methods.

The whole URL in this case is 966 chars long, after research it seems that the maxQueryStringLength value is 2048 by default but can overridden to any value of type integer, so just for grins I added the

<security>
  <requestFiltering>
    <requestLimits maxQueryString="2048"></requestLimits>
  </requestFiltering>
</security>

key to the web config file under the key.

No joy there, so I got ridiculous and made it 4096, still no joy.

Now with the whole URL being 966 chars long, the authorize attribute cannot seriously be adding another 1082-3130 chars, so how can I determine what the error actually is, or why the setting is not taking effect.

VS2010 Pro SP1

Answer 1

In the root web.config for your project, under the system.web node:

<system.web>
    <httpRuntime maxUrlLength="10999" maxQueryStringLength="2097151" />
...

In addition, I had to add this under the system.webServer node or I got a security error for my long query strings:

<system.webServer>
    <security>
      <requestFiltering>
        <requestLimits maxUrl="10999" maxQueryString="2097151" />
      </requestFiltering>
    </security>
...