title: Error: A potentially dangerous Request.Path value was detected from the client (&)
body: <p>I'm getting this error when attempting to set the Uri to the SSRS 2014 Report Server Uri. Here's the code where the error occurs.</p>
  
  <pre><code>mReportViewer.ServerReport.ReportServerUrl = New System.Uri("http://MONROE:80/ReportServer_SQL2014")
  </code></pre>
  
  <p>This is on a new ASP.NET 4.0 web application that I am testing before release. The exact same code executes fine under the current production version of this web application which is .NET 3.5.</p>
  
  <p>I can't see what's dangerous about this URL. I'm wondering if it could be something else that's causing the error, however, this appears to be the offending line of code because if I comment this out, the page loads normally (albeit without rendering the report).</p>
  
  <p>Any thoughts??</p>
  
  <p>---- UPDATE - 5/3/2018</p>
  
  <p>Removing the :80 (not really needed) _ from the report server name solved the issue with the illegal path name, but now I'm getting another strange error.
  <a href="https://i.stack.imgur.com/t6efv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/t6efv.png" alt="enter image description here"></a></p>
  
  <p>The really strange thing is that this same web application and report viewer works fine on my development machine using IIS Express. Also, this report URL works fine in the production version under ASP.NET 3.5.</p>
  
  <p>Any ideas on what path or file name is the concern here, because <a href="http://MONROE/ReportServer_SQL2014" rel="nofollow noreferrer">http://MONROE/ReportServer_SQL2014</a> is definitely not 248 characters in length!</p>
  
  <p>Here's the code for the Application_BeginRequest procedure...</p>
  
  <pre><code>   Sub Application_BeginRequest(ByVal Sender As Object, ByVal E As EventArgs)
      ' This solves a vulnerability issue
      ' Microsoft Knowledge Base (KB) article 887459, "Programmatically Checking for Canonicalization Issues with ASP.NET,"
      If (Request.Path.IndexOf(Chr(92)) &gt;= 0 Or
        System.IO.Path.GetFullPath(Request.PhysicalPath) &lt;&gt; Request.PhysicalPath) Then
  
          Throw New HttpException(404, "Not Found")
      End If
      ' The following line must be restored when moving to production on a site with a secure certificate
      If ((Not HttpContext.Current.Request.IsSecureConnection) And (Not HttpContext.Current.Request.IsLocal)) Then
          Response.Redirect("https://" &amp; Request.ServerVariables("HTTP_HOST") &amp; HttpContext.Current.Request.RawUrl)
      End If
  </code></pre>