Intercepting an HTTP 400 request/response

Hi All,

On one of our web apps, users have occassionally reported getting the error
"Bad Request (Request Header Too Long)"

I am able to reproduce this behavior by setting my user agent to a 16kb string. 
15kb doesn't cause any problems.

However, in the case of our users, I don't know what request header it is that
is causing this error.  I'm hoping there's some way that I will be able to
intercept the 400 request in code, and log the complete request headers?  Can
anyone think of a way to do this?  I tried setting a custom error document for
the 400 status code, but it doesn't get called--I'm guessing that IIS intercepts
the request and never passes it off to my page to process.

Any suggestions?  How can I get at these requests to figure out what is going
on?

  -Josh

When you say you tried to set a custom error document for the 400 status code,
did you try this in your web.config or in the IIS side?  You should be able to
set a custom handler in IIS if it's not workting through web.config.  It's on
the Custom Errors tab of the site/directory properties in IIS (at least in IIS6,
which I'm looking at).

Also, if logging is turned on, check the IIS logs to see the user-agent strings.
 If Logging is enabled, User-Agent is one of the fields logged by default.  You
can check this in the website properties of IIS.

dprior:

When you say you tried to set a custom error document for the 400 status code,
did you try this in your web.config or in the IIS side?  You should be able to
set a custom handler in IIS if it's not workting through web.config.  It's on
the Custom Errors tab of the site/directory properties in IIS (at least in IIS6,
which I'm looking at).


 

I set it in IIS.  I wasn't even aware you could change the web.config to set a
400 document.

dprior:

Also, if logging is turned on, check the IIS logs to see the user-agent strings.
 If Logging is enabled, User-Agent is one of the fields logged by default.  You
can check this in the website properties of IIS.


 

I've already checked this, and it's not the user agent string.  The only other
thing I could imagine would be cookies -- but I'd really like to be able to see
the raw request headers to try and figure out what's going on.