I was browsing the web and typed in a URL to visit, when I received the following response:

A potentially dangerous Request.Path value was detected from the client (&)

I did some research on this error and found that this is associated with cross-site scripting, and began to worry when I discovered that this could be interpreted as someone trying to hack into a website??

I see ampersands in URLs I visit all of the time (I saw many when I just did a Google image search), so I didn't think it anything malicious.

What does this mean for me? Should I be concerned?

  • What did the full request URL look like?
    – Arminius
    Mar 25, 2018 at 21:42
  • media.gettyimages.com/photos/…
    – user173913
    Mar 25, 2018 at 21:50
  • While I can't reproduce the error from the link you provided, it just seems to be an overeager WAF which triggers when it encounters a & where it doesn't belong. It's most likely a false positive and nothing to worry about.
    – Arminius
    Mar 25, 2018 at 21:56
  • That is weird. When I typed it, it took me to the error page. But when I clicked on it, it took me to the (royalty free) photo. I'm afraid to click on the link I provided but that's the one that was typed.
    – user173913
    Mar 25, 2018 at 22:05
  • This malformed URL triggers: media.gettyimages.com/photos/… (I replaced the ? with a &.)
    – Arminius
    Mar 25, 2018 at 22:07

1 Answer 1


You tried to visit a website with a malformed URL in it. A web application firewall (WAF) or similar thought it looked a little bit suspicious, and blocked your request. Apparently, the WAF is not configured veyr well, so it displays error messages to the user, instead of just a 404 page.

Regarding & in URL:s, they would normally be seen in the query string (the part after the ?). There, they are used as separator between different parameters, as in ?color=green&size=medium. I don't think putting them in a different part of the URL is a sign of any specific attack. But it's not a bad idea to block odd input even if it is not obviously an attack, just to be on the safe side.

So to summarize: Nobody tried to attack you. The webserver mistook a misspelled URL you visited for a potential attack, and blocked it. That's completely normal. You don't need to be worried about anything here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .