title: Why does the default setting for `requestPathInvalidCharacters` exclude otherwise-allowed characters?
body: <p>In ASP.NET, the <code>httpRuntime/@requestPathInvalidCharacters</code> attribute defaults to <code>&lt;,&gt;,*,%,&amp;,:,\</code>. These characters, as I understand, are disallowed in the path portion of a URL (based on the default setting of this attribute), but some of them should be allowed. Out of that list, I struggle to understand why <code>*,&amp;,:</code> are disallowed by default. E.g., the following URLs are <em>valid</em> but would be rejected by default by ASP.NET:</p>
  
  <p><em>To get a unique person by email:</em> <a href="http://myservice.com/People/Email=jim@smith.net" rel="noreferrer">http://myservice.com/People/Email=jim@smith.net</a></p>
  
  <p><em>To get a unique locality within a state:</em> <a href="http://myservice.com/States/VA/Localities/FIPS=001" rel="noreferrer">http://myservice.com/States/VA/Localities/FIPS=001</a></p>
  
  <p>I could also swap out the <code>=</code> for <code>:</code> to make ASP.NET reject the URL by default. But these characters/URLs are valid and should/do work fine.</p>
  
  <p>So, does anyone have any insight into why these disallowed characters were chosen?</p>
  
  <p>(Related post/answer: <a href="https://stackoverflow.com/a/13500078/374198">https://stackoverflow.com/a/13500078/374198</a>)</p>