Need an explanation on behaviour of WebApi method with string paremeter [duplicate]

Question

This question already has answers here:

A potentially dangerous Request.Path value was detected from the client (*) (9 answers)

Closed 9 years ago.

I have WebApi method with string parameter:

public IEnumerable<Foo> Get(string stuff)
{
  //do stuff
}

Route:

config.Routes.MapHttpRoute(
    name: "DefaultApi",
    routeTemplate: "api/{controller}/{stuff}",
    defaults: new { stuff= RouteParameter.Optional }
);

If I am calling the method like that: http://localhost:13892/api/servce?stuff=https://mysite.com/bla?g=1 - all good

but if I go http://localhost:13892/api/servce/https://mysite.com/bla?g=1 - getting error: A potentially dangerous Request.Path value was detected from the client (:).

I know how to fix that error but I am wondering why it is happening? Why in first case I am do not getting that error?

Answer 1

A simple explanation would be that the character : contained in the parameter is not allowed as part of the URL, but is perfectly legal to use in the querystring

Please note that this is possibly a dupliacate of A potentially dangerous Request.Path value was detected from the client (*)