Remove all IIS error messages via <httpErrors> in web.config - asp.net-mvc

I'm implementing the following:
<httpErrors errorMode="Custom">
<remove statusCode="404" />
<error statusCode="404" path="~/Error" responseMode="ExecuteURL" prefixLanguageFilePath="" />
<remove statusCode="500" />
<error statusCode="500" path="~/Error" responseMode="ExecuteURL" prefixLanguageFilePath="" />
</httpErrors>
However I'd like to remove ALL IIS error pages so that none of my internal details are exposed on 404, 403, 500 etc. I've tried to use:
<remove statusCode="*" />
To no avail. Is there a standard solution here?


As #Peter said, you can use the <clear> element.
You can use the <remove> element to remove a specific error message from the collection of error messages your site or application inherits from a higher level in the IIS configuration hierarchy. Also, you can use the <clear> element to remove all HTTP error messages from the collection of HTTP error messages that your site or application inherits.
Reference: iis.net
Example:
<httpErrors errorMode="Custom">
<clear />
<error statusCode="404" path="/Error" responseMode="ExecuteURL" />
<error statusCode="500" path="/Error" responseMode="ExecuteURL" />
</httpErrors>
(Side note: Virtual paths are not allowed in the path attribute of the error element.)

Related

Deploy ASP.NET MVC on Azure Format of the initialization string does not conform to specification starting at index 0

I make the first deployment of my application on Azure
and I get an error
Format of the initialization string does not conform to specification
starting at index 0.
I added to my web.config code to see custom errors, I mean:
<customErrors mode="Off" />
and
<httpErrors errorMode="Custom">
<remove statusCode="404" />
<error statusCode="404" path="/Error/Error404" responseMode="ExecuteURL" />
<remove statusCode="500" />
<error statusCode="500" path="/Error/Error500" responseMode="ExecuteURL" />
<remove statusCode="403" />
<error statusCode="403" path="/Error/Error403" responseMode="ExecuteURL" />
</httpErrors>
I dont really know how to deal with this error.
Link to github:
https://github.com/LNwwv/Memes-Web-site
Link to this websie:
https://memesproject.azurewebsites.net/

Your ApplicationDbContext constructor references a connection string called DefaultConnection but your web.Release.config references one called MemesProject
Use the same connection string name regardless of the environment and update the value.

I resolve my problem in publish menu i had to manualy select connection string to database

Error returning html response instead of error page

I've setup a custom error.html page and when a user tries to upload a large file it throws an error due to max request length (expected behaviour).
However, instead of returning a rendered page it returns the html of the error page and the network shows a 200 response instead of 500.
Here is what I have in the web config
<system.web>
<customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/error.html">
<error statusCode="404" redirect="~/error.html" />
<error statusCode="500" redirect="~/error.html" />
</customErrors>
</system.web>
and under the webServer section
<system.webServer>
<httpErrors errorMode="Custom">
<remove statusCode="404" />
<error statusCode="404" path="error.html" responseMode="File" />
<remove statusCode="500" />
<error statusCode="500" path="error.html" responseMode="File" />
</httpErrors>
</system.webServer>
It could be that these sections maybe conflicting with each other.
The expected error page is displayed for a 404.
(Increasing the limit is possible but won't stop the issue happening from a different error)

httperrors existingResponse="Auto" doesn't serve custom pages

I'm trying to show custom pages in case of custom errors.
This is my configuration:
<httpErrors existingResponse="Auto" defaultResponseMode="ExecuteURL" errorMode="Custom">
<clear/>
<remove statusCode="403"/>
<error statusCode="403" responseMode="ExecuteURL" path="/403.html"/>
<remove statusCode="404"/>
<error statusCode="404" responseMode="ExecuteURL" path="/404.html"/>
<remove statusCode="500"/>
<error statusCode="500" responseMode="ExecuteURL" path="/500.html"/>
</httpErrors>
It works fine for IIS errors if I use existingResponse="Replace".
But that also rejects TrySkipIisCustomErrors that is quite needy
I don't know how to fix it. If I use replace, it breaks my functionality and if I use Auto then it doesn't serve my custom pages for IIS
Any help will be appreciated

Elmah not logging 404 errors after third folder, and 403 errors at all

Continuing my previous question, I handle custom errors in my mvc5 app using:
<system.webServer>
<httpErrors errorMode="Custom" existingResponse="Replace">
<remove statusCode="404"/>
<error statusCode="404" path="/Errors/NotFound" responseMode="ExecuteURL" />
<remove statusCode="403"/>
<error statusCode="403" path="/Errors/NotFound" responseMode="ExecuteURL" />
<remove statusCode="500"/>
<error statusCode="500" path="/Errors/ServerError" responseMode="ExecuteURL" />
</httpErrors>
...
</system.webServer>
This enabled me to show custom 404 error page after the 3rd folder (e.g. site.com/a/b/c/nothing-here). Yet, Elmah is not logging these errors. This is also true for 403 errors. So My questions are:
is there a way to make Elmah handle all server errors regardless of
being thrown by the mvc app itself?
if not, since /Errors/NotFound is successfully executed, I can add a log from that action. is there a way to tell if Elmah already handled this error (or was it thrown by the mvc app)?

Is it possible to use custom error pages with MVC site but not Web API?

I have an MVC project with a /api folder which contains my Web API controllers. I want the following things:
My MVC site to serve a custom error page when an error occurs
My Web API to serve the default error response (json/xml containing exception and stack trace)
In the web.config for my MVC site, I have an httpErrors node, and have set the errorMode to "Custom" so that I can have nice error pages when 404s/500s/etc. occur during browsing of the MVC site:
<httpErrors errorMode="Custom" existingResponse="Replace">
<remove statusCode="404" subStatusCode="-1" />
<remove statusCode="500" subStatusCode="-1" />
<remove statusCode="403" subStatusCode="-1" />
<error prefixLanguageFilePath="" statusCode="404" path="Content\notfound.htm" responseMode="File" />
<error statusCode="500" path="/Errors" responseMode="ExecuteURL" />
<error statusCode="403" path="/Errors/Http403" responseMode="ExecuteURL" /></httpErrors>
With that configuration however, the API will serve the custom error page when an error occurs, not json/xml with the exception/stack trace (which is the desired behavior).
Is there a way to configure custom errors to only apply to my MVC site and not the Web API? This blog says there is not (http://blog.kristandyson.com/2012/11/iis-httperrors-aspnet-web-api-fully.html), but I'd like to hear if anyone else has found a work around since that blog was published.
I suppose if there is not I could create a separate project/assembly for my Web API project. That would allow me to configure httpErrors for MVC and Web API separately, but I would prefer not to create another project just so I have yet another web.config to configure.

Well, after a nearly a year of letting this question marinade, I gave it another shot. Here's the web.config magic that got me what I wanted:
<!-- inside of <configuration> to allow error
responses from requests to /api through -->
<location path="api">
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<httpErrors errorMode="DetailedLocalOnly" existingResponse="PassThrough" >
<clear/>
</httpErrors>
</system.webServer>
</location>
<!-- original httpErrors, inside of <location path="." inheritInChildApplications="false">
to serve custom error pages when the MVC site returns an error code -->
<httpErrors errorMode="Custom" existingResponse="Replace">
<remove statusCode="400" subStatusCode="-1" />
<remove statusCode="404" subStatusCode="-1" />
<remove statusCode="500" subStatusCode="-1" />
<remove statusCode="403" subStatusCode="-1" />
<error statusCode="400" prefixLanguageFilePath="" path="Content\notfound.htm" responseMode="File"/>
<error prefixLanguageFilePath="" statusCode="404" path="Content\notfound.htm" responseMode="File" />
<error statusCode="500" path="/errors" responseMode="ExecuteURL" />
<error statusCode="403" path="/errors/http403" responseMode="ExecuteURL" />
</httpErrors>
The crux of what's going on here is that the <location> node allows you to override settings made at a less specific path. So while we have errorMode="Custom" for path=".", we override that for the our Web API's path with the <location path="api"> node, and the httpErrors configuration within it.
I had seen nodes before, but it didn't dawn on me that this was their purpose until now. This article goes into more detail on the configuration inheritance model of IIS/.NET, which I found very informative: http://weblogs.asp.net/jongalloway/10-things-asp-net-developers-should-know-about-web-config-inheritance-and-overrides

I have not tested this, but how about writing the code to handle your MVC application errors, like shown here http://thirteendaysaweek.com/2012/09/25/custom-error-page-with-asp-net-mvc-4/ ?
His code show that he is doing this at the application level (Global.asax), but I guess you could just as well trap exceptions at a lower level in the same way, with one method for MVC and another one for Web API.

What have worked for me:
<httpErrors existingResponse="Auto" defaultResponseMode="Redirect" errorMode="Custom">
<remove statusCode="403" subStatusCode="-1" />
<error statusCode="403" subStatusCode="-1" responseMode="Redirect" path="<!--path here-->" />
<remove statusCode="404" subStatusCode="-1" />
<error statusCode="404" subStatusCode="-1" responseMode="Redirect" path="<!--path here-->" />
<remove statusCode="500" subStatusCode="-1" />
<error statusCode="500" subStatusCode="-1" responseMode="Redirect" path="<!--path here-->" />
</httpErrors>
Seems like just setting existingResponse="Auto" will do the job.

Resources