From Jason Block @ http://www.angrycoder.com/article.aspx?cid=5&y=2003&m=4&d=15 Basically, it's [Request.UrlReferrer] doing a lazy initialization of its internal _referrer field, which is a Uri-type class. That is, it's not created until it's needed. The point is that there are a couple of spots where the UriFormatException could leak through. One is in the call to GetKnownRequestHeader(). _wr is a field of type HttpWorkerRequest. 36 is the value of the HeaderReferer constant - since that's being blocked in this case, it may cause that exception to occur. However, HttpWorkerRequest is an abstract class, and it took a trip to the debugger to find out that _wr is set to a System.Web.Hosting.ISAPIWorkerRequestOutOfProc object. This descends from System.Web.Hosting.ISAPIWorkerRequest, and its implementation of GetKnownRequestHeader() didn't seem to be the source of the problem.