A techie answer...

[mapsedge]

The answer, if somewhat imprecise in the details, seems to be querystring length.

I created a page with a series of forms, each one sending an HTTP GET with more information in each one, in increments of a few hundred characters, one set with plain ASCII, another with plain ASCII that'd been URLEncoded (javascript equiv: escape()).

Their system broke the page between 470 and 630 characters, with or without fancy formatting.  So, I'm guessing there's an arbitrary limit on their firewall of 500-ish characters.  Why the hell? Or, in current vernacular, WTF?  What are they hoping to prevent or fix?  It's a mystery.  Pretty soon the wax will melt and milk flow from the statue's nipples.  Oooooh, aaaaaaaaaah.

So, into the code I went, and just as well.  We hadn't had an audit for a long time and there was plenty of unecessary stuff in there.  I trimmed out uneeded parameters and got the querystring down under 300 characters on all but the most complex of searches, where we still don't break 400.

I've already spoken on the phone with the client and he's done a preliminary test and it works.  And now it's down to testing each button and link to make sure they pass the correct parameters, and I'll hand it back over to the client for a final go-through before we publish the changes.

I am, as you might imagine, way behind on every other project in the queue.

Comments

[jehosefatz.livejournal.com]

500-ish is very small (WTFS, IMO), but limiting URL length is a way to limit the possiblity of a buffer overflow vulnerability and/or malicious code injection.

- Jeho

[ladyniniane.livejournal.com]

What he said.....

And I'm glad you seem to have some sort of work-around for it.