Windows Server 2019: IIS 10: HTTP Error 403.14 - Forbidden: The Web server is configured to not list the contents of this directory - asp.net-mvc

All,
I am migrating a working .Net Framework Website from IIS 8.5 on a Microsoft Windows Server 2012 to IIS 10 on a Microsoft Windows Server 2019.
The new web site is showing the error
HTTP Error 403.14 - Forbidden
The Web server is configured to not list the contents of this directory.
As far as I can see the website on the new server is configured the same as on the existing.
Neither have directory Browsing enabled nor a default file set as is recommended by most of the posts which exist discussing this error.
I have run the following which is also recommended.
%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -ir
The problem still exists.
I came across a post saying there might be an issue if paths referenced in the web.config are not correct but they look fine.
Has anyone got any insight into what else might cause this issue?
Are there any differences between IIS 8.5 and IIS 10 or between windows servers 2012 and 2019 which might cause this issue?
Thanks

This problem occurs because the website doesn't have the Directory Browsing feature enabled. Also, the default document isn't configured. To resolve this problem, use one of the following methods:
Method 1: Enable the Directory Browsing feature in IIS
To resolve this problem, follow these steps:
Start IIS Manager. To do it, select Start, select Run, type inetmgr.exe, and then select OK.
In IIS Manager, expand server name, expand Web sites, and then select the website that you want to change.
In the Features view, double-click Directory Browsing.
In the Actions pane, select Enable.
Method 2: Add a default document
To resolve this problem, follow these steps:
Start IIS Manager. To do it, select Start, select Run, type inetmgr.exe, and then select OK.
In IIS Manager, expand server name, expand Web sites, and then select the website that you want to change.
In the Features view, double-click Default Document.
In the Actions pane, select Enable.
In the File Name box, type the name of the default document, and then select OK.
More information you can refer to this link: HTTP Error 403.14 - Forbidden when you open an IIS webpage.

All those clowns glibly posting that "HTTP Error 403.14 - Forbidden: The Web server is configured to not list the contents of this directory" can be fixed by configuring the web site by either enabling the Directory Browsing feature or adding a default document are really not understanding what they are talking about. Anyone can copy a solution from one post and paste to another.
I'm not going to pretend I know what I am talking about but I have fixed my issue and will share what I did here to see in the hope it helps others.
I created a project (of the same type as the application I was trying to deploy) using my IDE (MSVS) in the same .Net version of the application I was trying to deploy. In this case it was creation of an MVC project in .Net Framework 4.5.
I did nothing to it. All I wanted was a skeleton.
I replaced all the files in the home directory of the web site I had an issue with, with the files of this skeleton project.
I attempted to browse to the web site and it worked successfully. Note the directory browsing was not enabled nor was a default directory set.
This proved to me that those settings were irrelevant.
Having googled around, some sites point to paths in config files causing an issue if they do not exist, eg a logging path to d:\logs where that directory was missing. It didn't fix my issue but there's no harm checking.
I stumbled across a post which talked about the roles and features enabled on the server. In Web Server (IIS)/Web Server/Application Development they had selected "Application Initialisation" and "ASP".
The Windows Sever 2012 server I was moving the application from, where it work without a hitch, did not have those selected so had not selected them on the Windows Server 2019 I was moving them to when I set that server up.
It made no sense that this would be the solution but having tried everything else I activated those two options.
Stone me if the issue was resolved.
As a check I removed those two options and the problem came back and when I reselected them it went away again.
This struck me as pretty conclusive only having thought I'd found the cause of the problem I built the website from scratch and the problem came back again.
It took a number of iterations but eventually I got there, more by luck than judgement and whatever the cause was it was due to an issue in the application which wasn't being logged in event viewer so focus on permissions to files being written to: not only that the app pool account is set up on the directories it needs access to but also that it has modify or even full control.
All those muppets robotically posting advice on configuring the web site by either enabling the Directory Browsing feature or adding a default document will no doubt copy this and paste it into their posts to claim the credit but c'est la vie.
I hope this post is of use to someone, apart from those muppets.

Related

MVC WebApplication no longer starts in IIS Express (redirects to https://localhost in Chrome)

I was changing OAuth/Owin settings and Azure publish settings in a Web Application project this morning, but soon after we decided deployment will be to a specific IIS Azure VM (now visible across our local domain). All code/setting changes have been reverted.
At one point I also changed the drivers\etc\hosts file to allow a dummy name for Microsoft OAuth, but that has been reverted.
Notes:
My startup URL is http://localhost:22222/
I am running under IIS Express (as my local Dev VM will not allow me to install full IIS)
When I start the Web Application with IE I simply get "This page can't be displayed"
If I start it with Chrome I get "This webpage is not available", but it also changes the browser URL to https://localhost (note the s, i.e. using SSL).
I have pulled the project down fresh from source control. No change.
The project is under TFS source control.
Another developer on the same project has the latest files and it works fine.
If I run any other Web Application project, they work just fine.
All OWIN registration of providers has been commented out. No change.
Deleted the entire project folder and pulled fresh from TFS. No change. This probably means a local machine setting somewhere is the cause?
What could I have damaged in my Web Application to cause this problem? I have been scratching my head for hours now and nothing we try is working. The application simply will not start in any browser.
Project Web Settings tab:
Answer at bottom, given to this chromium issue [issue 444479] helped me:
Same here - I also believe caused by HSTS - see
http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
If you have (developed) any other localhost sites which send a HSTS
header...
eg. Strict-Transport-Security: max-age=31536000; includeSubDomains;
preload
...then depending on the value of max-age, future requests to
localhost will be required to be served over HTTPS.
To get around this, I did the following.
In the Chrome address bar type "chrome://net-internals/#hsts"
At the very bottom of a page is QUERY domain textbox - verify that localhost is known to the browser
If it is, DELETE the localhost domain using the textbox above
Your site should now work using plain old HTTP
HTH,
Jay
ps. This is not a permanent solution, but will at least get it working
between projects. If anyone knows how to permanently exclude localhost
from the HSTS list please let me know :)
Give it a try.

How to precompile MVC for intranet?

VS2013 Update3, .Net 4.5, MVC, IIS 7
I created a new mvc project.
Tested from VS and it works.
From IIs, I created a folder in wwwroot, and made it an application. Add app pool with .net 4.0. Enabled windows authentication and disabled Anonymous authentication. Set service account in app pool and webapp.
From VS I deploy to IIS with default settings (which is NOT precompile) (using File System)
Site works fine on IIS.
But…
If deploy with the precompile setting clicked on. Web site fails with 403 error. Tried various combinations and get never get the precompiled to work. Always works when non-precompiled.
ASP.NET 4 was is registered in IIS.
Tried modules runAllManagedModulesForAllRequests="true" with no success.
I'm out of ideas and looking for help
Server Error in Application "xxx/MVCHELLOWORLD"
Internet Information Services 7.5
Error Summary
HTTP Error 403.14 - Forbidden
The Web server is configured to not list the contents of this directory.
Detailed Error Information
Module
DirectoryListingModule
Notification
ExecuteRequestHandler
Handler
StaticFile
Error Code
0x00000000
Requested URL
http://xxx/MvcHelloWorld/
Physical Path
C:\inetpub\wwwroot\MvcHelloWorld\
Logon Method
Negotiate
Most likely causes: •A default document is not configured for the requested URL, and directory browsing is not enabled on the server.
Things you can try: •If you do not want to enable directory browsing, ensure that a default document is configured and that the file exists.
• Enable directory browsing using IIS Manager. 1.Open IIS Manager.
2.In the Features view, double-click Directory Browsing.
3.On the Directory Browsing page, in the Actions pane, click Enable.
•Verify that the configuration/system.webServer/directoryBrowse#enabled attribute is set to true in the site or application configuration file.
Links and More InformationThis error occurs when a document is not specified in the URL, no default document is specified for the Web site or application, and directory listing is not enabled for the Web site or application. This setting may be disabled on purpose to secure the contents of the server.
View more information »
I just had the same issue and have been trying to resolve it for the last couple of days.
I have a Windows 8 pc running IIS 8 Express.
I copied an MVC site that was compiled and published from another pc, ran it, and got the same 403.14 forbidden as above. I then tried publishing the site uncompiled and running it and the site loaded just fine.
I then decided to load Visual Web Express on the Windows 8 pc and created a dummy MVC site and ran it compiled and uncompiled and it worked just fine. This showed me that IIS 8 Express was configured and working properly and there must be some issue in the way the site was compiling.
I tried different precompile methods during the publish including do not merge, merge all and merge each folder but none of those many any difference.
In the end I solved this by changing the Copy Local property to true for every Assembly referenced within the project. Even all the default ones that should be referenced from the GAC.
Not sure if I needed to copy every assembly to the bin folder or not but given the large number of assemblies referenced within my project this seemed easier then trying them 1 by 1.
EDIT: Made some changes and republished the site and now I'm back to the 403.14 forbidden again :(
I'm really pulling my hair out on this one as to why it isn't working.

W2K8 server running IIS7 VS Express Web Deployment

(EDIT) - I decided to make this page more like instructions since i have figured this out.
Deploy my VS Express 2013 Web Application to an MS Server on my LAN running:
Windows Server 2008 Standard
IIS 7.0
MS SQL Express
This is some information to help anyone with a similar situation.
I can access the Web Application locally (from VS Express) when I click Debug - Start Debugging. ALSO - At this point it is connected to the MS SQL Express Server on my LAN and not a local database.
Time to publish the Web Application to my IIS 7 Server!!!
NOTE - The method below WORKS FOR ME. There might be better ways to do it but I found any info on this exact setup very limited.
VS Express 2013 Web Deploy pre-reqs:
(on IIS 7 Server)
-Web Deploy is installed, http://www.iis.net/downloads/microsoft/web-deploy
-Set Up Security on Web Deploy, this site helps:
http://www.iis.net/learn/install/installing-publishing-technologies/installing-and-configuring-web-deploy
In Project:
Right Click your project name, choose PUBLISH...
PROFILE - Name or import your profile
CONNECTION
-Server: LAN address of your IIS server
-Site Name: Name of Site on IIS
-User/Pass: (Credentials you set up earlier in Prerequisites)
-Destination URL: (I leave blank for now)
SETTINGS - Click the arrow below FILE PUBLISH OPTIONS and check the 'Exclude App Data' setting (this is assuming you are running MS SQL on the IIS Server).
Select your Database string, it should be in the drop down list)
PREVIEW - Web Deploy will give you errors when you try to PREVIEW, resolve these errors using MS Websties, Stack Overflow, etc. **WHEN YOU GET THIS ERROR: "#ERROR_FRAMEWORK_VERSIONS_DO_NOT_MATCH" (full Error message below), your Web Deployment is ready
PUBLISH the web deployment, it wont work, thats okay. It creates a publish profile
Right-click the project and choose PUBLISH again, this time use under the CONNECTION tab choose WEB DEPLOYMENT PACKAGE, take note of your folder location (Step 8). All the database/file settings should be the same (doublecheck if you like), PUBLISH the Web Deployment package
Log onto your IIS Administration (on the Server), right click the NAME of the Server (top level) and choose DEPLOY - IMPORT SITE. Navigate to the folder where you saved the package in step 7. (or transfer it with a USB Stick, etc)
IMPORTANT - When importing the profile, at the second screen, UNCHECK the boxes related to .NET 32-Bit etc. (there are two of them)
Leave everything else on defaults and import the site (successfully?).
At this point when I browse the site from IIS I get a 403 Forbidden Error.
I fixed this using code from comment below:
After that my Web App was from the IIS Server. I'm continuing with MVC tutorials found here:
http://www.asp.net/mvc/tutorials/mvc-5
I'm hoping once I understand enough about MVC and EF6 I can connect the Web App to MySQL rather than MS SQL and still build Code First Applications. If anyone has info on that please post it in the comments.
If this post helped you please Vote up top, I'm new to the STACK.
**Full Error Message from post above:
Web deployment task failed. (The versions of the .NET Framework Configuration Provider (rootWebConfig32) are different on the source (4.0) and destination (2.0). Learn more at: http://go.microsoft.com/fwlink/?LinkId=221672#ERROR_FRAMEWORK_VERSIONS_DO_NOT_MATCH.)
I think your issue might be permissions. What is your authentication set to? In debug mode, you're typically working as yourself, whereas if you deploy, you are setup as a different user, most likely anonymous. With that in mind, you should be able to correct your problem.
Good luck!
It was a combination of things. I finally got it working.
I created a Deployment package following instructions found on MS site and others.
Before Publishing my deployment package, I ran a "Preview" (PREVIEW section of the wizard). This was bringing up various errors related to Security and other issues I fixed using MS support sites.
WHAT I FOUND ON MY OWN - (Its fairly simple), after you create the Deployment package without issue, go to IIS on the Server side, click the Server Name in IIS (top level) and choose Deploy - Import Package. In the second or thu=ird step there is a screen where you select items to be imoported (mine had everything checked). I UNCHECKED the two related to .NET Config files and imported it. Voila, it worked.
It still wasn't letting me view the site. I had to add this line to the web.config file and it fixed everything.
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
If anyone wants a mored etailed description of what I did let me know and I will try and redo my process/tutorial with more exact instructions.
to get the same publish behaviors with direct publish from VS, you can uncheck following box : properties\Package/PublishWeb\include IIS express settings as configured in ISS express

ASP.NET4.0 MVC4 IIS7.5 Error 403.14 I'm Literally Pulling Out My Hair

I want to get away from developing in PHP but doing that is proving to be a massive headache.
I am trying to set up a website with MVC 4, ASP.NET 4.0, on Win7 Professional (64-bit). The website is just the basic site that is set up with Visual Web Developer 2010 Express selecting New Project > C# > Website > ASP.NET MVC 4 Application.
After setting up the application in IIS7.5 I am getting an HTTP Error 403.14 - Forbidden. I've done a ton of research and tried multiple different suggestions on how to solve the problem but NOTHING is working. Here are some things I tried:
Install/Register v4 of ASP.NET. This has been the most annoying
thing because everyone else's issue is fixed when they do this but
mine is not.
Changing the application pool settings:
Set to classic/integrated mode
Change the user/permissions used by the application pool
Made sure 32-bit applications were enabled
Added security permissions to folders related to the website (on multiple accounts)
I can get a regular html document to show up if I add it to the websites root directory. It seems that the MVC stack is not being called at all. The server wants to display the directory, which I can enable/disable, but the website is not being displayed.
Please can I have more potential fixes before I resort to my last desperate act? A baseball bat.
p.s. I'm more than willing to do a skype conversation or a share screen kind of thing if someone wants to dig in deep. I am beyond frustrated with this.
So it seems, in my indefinite well of stupidity, I was pointing the webserver to the incorrect folder. I needed to point the webserver to the folder with actual files of the application rather than the folder containing the .SLN file. Sorry to waste your time!
try running the aspnet_regiis
http://msdn.microsoft.com/en-us/library/k6h9cz8h.aspx
open the command line in %windir%\Microsoft.NET\Framework64\v4.0.30319 and run
aspnet_regiis -ir
other possible solutions:
quit skype, or any other similar applications

Disable Visual Studio Web Server Directory Browsing

I'm using Visual Studio's built in web server to test and EPiServer applicaiton. When I have the app running in IIS, if I hit the root of the virtual directory, EPiServer will take over and server the defaul page to me. Using the Visual Studion server (which I am doing for license reasons with the SDK), it always gives me the 'Directory Listing' view of my site. Does anyone know how to configure this web server to not allow the directory listing/browsing?
Additional Information:
This problme only seems to effect the root of the visual studion web server (i'll call it cassini from here on in). As an example, if I run a site from localhost:6666, then what I will find is that localhost:6666/en/ will work just fine and the EPiServer VPP will know what it is doing. If I use localhost:6666/, then the VPP never kicks in (or so it seams). It seems to me that when the root of cassini is hit, it checks to see if the page exists (which it does not as I have no default). If it decides that the page does not exist, then it serves up the directory listing, rather than 404. The first thing to do for me is to dispable directory browsing in cassini, then look at why the VPP is not being actioned correctly.
So I suppose the base of the question is: Is there a way to modify these settins in Cassini when it is Visual Studio starting everything off?
(EPiServer may be a red herring, but just in case, it's CMS version 5)
Further Update
I managed to get hold of the source for Cassini 3.5 and gave that a whirl. 3.5 works just fine and behaves like IIS in this instance. I.e. the lack of default document does not lead to a Directory listing, rather if allows the HTTP handlers to kick in and then EPiServer does the rest! So the question is, can I achieve the same in Visual Studios effort at a web server?
Make sure you have a ~/Default.aspx file. It won't render, but it's needed in cassini for the virtual path providers to get a chance to handle the request for '/'.
Of course, if you make it anyway you might as well use it for the start page :-)
Even if you could get the server to not show the directory listing, could you get EPiServer to take over?
EDIT: From comments
The fact that it works with /en/ makes me think this is something that Microsoft could fix. I suggest you ask the vendor if they have a workaround. If they do not, then please create a suggestion at http://connect.microsoft.com/visualstudio/. Be sure to specify details about EPIServer, URL to the vendor, etc.
Be clear that it works with /en, but you want a setting permitting it to work at the root.
Once you create the suggestion, please edit your question to include the link to the suggestion you create. That way, others reading your question can vote on how important they think this is.
The EpiServer part confuses me. However, if you are asking how to set the default page for the VS development server (based on the Cassini code), you're expected to do that in the project properties (right click on web project), Web, Start Action, Specific Page, foo.aspx.
I suspect the cassini/VS development server doesn't have a default page feature-- the source code for the cassini server (the ancestor of the VS development server) is on the web and you can check that and add a default page by building a custom version. And it doesn't have a very long list of other features that IIS has.
Which EPiServer version are you running?
Did you install it using EPiServer Manager?
There has always been some differences in the configuration between running the site at the root of a host name or as a (virtual) directory.
Check the site settings block in web.config and make sure you have a default.aspx at the project root.

Resources