Server variable value duplicated when IIS Default Document module invoked?

[Cantor, Scott]

That basically means it's a subrequest of some sort that maintains the values populated during the original request such that the SP appends the value again the second time. The original code was broken (like "insecure" broken) and part of the fix also made sure it maintains the string properly if there was a value present.

Apache doesn’t do this to my knowledge with its subrequests and I would say this is broken (meaning IIS is) since this is contaminating the data from one request with another. The fact that it manifests like this is nice, because it immediately screams "hey, that code's really broken".

That's not an SP bug, it means that Default Document module is dangerous.

Other than implementing a lower-layer option to de-duplicate things (again), there's not much to be done. Apache doesn't have this cross-contamination, the subrequest only shares some of the internal state of the original. Which is what it needs to do, and what this thing should be doing.

-- Scott