Coveo for Sitecore - Request Filtering, maxQueryStringLength, 500s & 404.15s

Common Setup Tweaks

UPDATE: Vincent Seguin, Team Leader at Coveo has notified me that this issue is fixed in the current version of Coveo as GET requests have been changed to POST. Great news!

When initially installing Coveo, you can expect to tweak your web.config to accommodate. This is because of Coveo's REST API and the large amount data it encodes into the request.

This resolves 500 and 404.15 errors related to both Coveo JS UI and Coveo for Sitecore's ContentSearch API.

Error: The length of the query string for this request exceeds the configured maxQueryStringLength value

Open you web.config and look under the *<system.web> > <httpRuntime /> > * node and increase both values as needed:

     <httpRuntime maxRequestLength="512000" executionTimeout="600" maxQueryStringLength="204800" enableKernelOutputCache="false" />

The above will fix 500 errors. We also need to fix 404.15 errors.

Error: 404.15 – Not Found: The request filtering module is configured to deny a request where the query string is too long

We also must also increase the url and query string values in the <requestLimits /> to address this:

        <requestLimits maxAllowedContentLength="5242880" maxQueryString="204800" />


Does increasing these values create a security risk? Not really. Limiting the lengths of URLs and query strings is primarily to limit to amount of code that could be injected as part of an attack. As long as your code has is not susceptible to injection attacks, this is not an issue.

We've penetration tested Coveo's REST API and found no such vulnerabilities.

This post was authored using Markdown for Sitecore.

👋 Hey Sitecore Enthusiasts!

Sign up to our bi-weekly newsletter for a bite-sized curation of valuable insight from the Sitecore community.

What’s in it for you?

  • Stay up-to-date with the latest Sitecore news
  • New to Sitecore? Learn tips and tricks to help you navigate this powerful tool
  • Sitecore pro? Expand your skill set and discover troubleshooting tips
  • Browse open careers and opportunities
  • Get a chance to be featured in upcoming editions
  • Learn our secret handshake
  • And more!
Sitecore Snack a newsletter by Fishtank Consulting

Meet Dan Cruickshank

President | Sitecore MVP x 11

Dan is the founder of Fishtank. He's a multi-time Sitecore MVP and Coveo MVP award winner. Outside of technology, he is widely considered to be a top 3 father (routinely receiving "Father of the Year" accolades from his family) and past his prime on the basketball court.

Connect with Dan