I'm struggling with a legacy app that uses special characters like %26 in the URL. The characters don't affect the app but can't be changed, so I'm trying to get IIS to deal with them.

I've tried to ignore them using multiple methods, but nothing seems to work.

So now I installed the IIS rewrite module and added a rewrite rule to web.config to replace the characters %26 with _, for example:

<rewrite>
    <rules>
        <rule name="ampersand" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*%26*" />
            <action type="Redirect" url="{R:1}_{R:2}" />
        </rule>
    </rules>
</rewrite>

The problem is that IIS responds with "Bad Request" before the rewrite rule ever gets called. So my question is this: how can I change the order of precedence so that the mod rewrite filter will be called before IIS puts the ban hammer down on that URL?