I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. This can be easily changed in a web.config file using the settings listed below.
system.web > httpRuntime > maxRequestLength
system.web > httpRuntime > maxUrlLength
system.webServer > security > requestFiltering > maxQueryString
system.webServer > security > requestFiltering > maxUrl
My question is whether there are any security concerns that I should be aware of if I allow very long querystrings in HTTP requests?
Update: I should add a few bits of info.
- The website will only be available to paid users who have signed into the website.
- The likelihood that anyone would create a search with more than 2048 characters in the url is VERY slim, but theoretically possible.