ASP.NET MVC Routing vs. Reserved Filenames in Windows - asp.net-mvc

In our ASP.NET MVC application, we've noticed that we cannot have The Forbidden DOS File Names—COM1 through COM9, LPT1 through LPT9, CON, AUX, PRN, and NUL—anywhere in our routes. They inevitably result in IIS telling us the file cannot be found, even when we set routing not to check for the existence of files first. How can we work around this?

This has been addressed in ASP.NET 4. http://haacked.com/archive/2010/04/29/allowing-reserved-filenames-in-URLs.aspx
You can apply a setting in web.config that relaxes this restriction.
<configuration>
<system.web>
<httpRuntime relaxedUrlToFileSystemMapping="true"/>
<!-- ... your other settings ... -->
</system.web>
</configuration>
Hope that helps.

Since asking the question, I've found that the bug is in ASP.NET proper, not IIS or ASP.NET MVC, meaning that there's no way to work around it. The only solution is to manually forbid URLs matching these names and these names followed by a period and random characters.

For a similar reason, there can't be a web.config tag in StackOverflow.
http://stackoverflow.uservoice.com/pages/1722-general/suggestions/98871-web-config-tag-404-error

for another similar reason you can't have urls with a dot and a slash
Semantic urls with dots in .net

Related

MVC4 404 Errors

I'm building out a series of MVC4 Web API's that return various bits of information. In most of the APIs, I'm conducting a GET method and passing a fully qualified domain name.
If I pass a short name the API returns the data as expected; however if I pass a fully qualified domain as an ID ending in ".com" I get a 404.
The API works fine when I debug within Visual Studio 2010; however once I "publish" the content, I start getting 404's. My initial hunch is that it's something with IIS; however I haven't been able to put my finger on the exact problem.
WORKS: /controller/action/server_shortname
404: /controller/action/server.domain.com
Any guidance would be appreciated. Thanks
If you are using .NET 4.0 you can use this in your web.config:
<httpRuntime relaxedUrlToFileSystemMapping="true" />
Apart from that you should also assure that you are running your applicationPool in integrated mode.
There are a few other posts that mention the same problem and depending on your configuration you could find your answer there:
How to get ASP.NET MVC to match dot (".") character at the end in a route?
ASP.NET MVC Url Route supporting (dot)
. has a special meaning in the path portion of an url and is interpreted by IIS as a extension separator.
If you are running in IIS Integrated Pipeline mode you could add the following handler to the <system.webServer> node:
<system.webServer>
<handlers>
...
<add
name="UrlRoutingHandler"
type="System.Web.Routing.UrlRoutingHandler, System.Web"
path="/api/*"
verb="*" />
</handlers>
</system.webServer>
You will only need to adjust the path="/api/*" to the endpoint that you configured your API to listen to.

ASP.NET RAZOR Urls? Getting 403

I used WebMatrix to play around and do a very simple site for learning. However, when I upload to an actual Windows server (yes, WebMatrix installed) The MVC style url's dont work.
If you go to http://173.201.29.98:88/
You'll see
But if you go to http://173.201.29.98:88/Default.cshtml
it works.
Anyone know what's wrong? I'll I've done is upload it, didn't use the "Publish" feature.
Lol, after looking more deeply in Stack Overflow I found the answer.
Razor page not working with Rewrite
Pretty Simple.
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>

Getting 404 error on MVC web-site

I have an IIS7.5 web-site, on Windows Server 2008, with an ASP.NET MVC2 web-site deployed to it. The website was built in Visual Studio 2008, targeting .NET 3.5, and IIS 5.1 has been successfully configured to run it as well, for local testing.
However, whenever I try and navigate to a page running in IIS7, I get a 404 error.
I have checked the following things:
There is no corresponding 404 log entry in IIS logs.
Actually, there are 404 entries in the IIS log.
The application pool for the web-site is set to use the Integrated pipeline.
The "customErrors" mode is set to off.
.NET 3.5 SP1 is installed
ASP.NET MVC 2 is installed
I've used MVC Diagnostics to confirm all MVC DLLs are being found.
ASP.NET is enabled in IIS, which we've demonstrated by running the MVC Diagnostics page.
KB 2023146 did highlight that HTTP Redirection was off, so we've turned it on, but no joy.
EDIT
Ok, so we've installed the world's simplest MVC application (the one which is created when you create a new MVC2 project in Visual Studio), and we are still getting 404s on any page we try and access - e.g.
<my_server>/Home/About will generate a 404.
Any ideas will be greatly appreciated!
This is quite often caused by the following missing from the web.config:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
Do you have a problem with just 1 page or the whole site is not working?
A) 1 page
You can use RouteDebugger to verify if the route is matched correctly
B) Whole site
I assume you're using Windows Server - check if ASP.NET is enabled in IIS - it's disabled by default, I believe.
You can use MvcDiagnostics page to check if all dlls are deployed properly.
Are you running in IIS7 integrated mode? Classic mode of IIS7 does not automatically map extensionless URLs to ASP.NET (much like IIS6)
Make sure your Web.config tag is configured correctly.
We finally nailed this issue by exporting the IIS configuration of a working server, and comparing it to ours.
It was a really obscure setting which had been changed from the default.
IIS ROOT → request Filtering → Filename Extensions Tab → Edit Feature Settings → Allow unlisted file name extensions
This should be ticked.
This can be set at the IIS level, or the site-level.
Glad that fixed your problem. Others researching this issue should take note of the extensionless URL hotfix: http://support.microsoft.com/kb/980368
If none of the other solutions here solved your issue, check that you have the
Global.asax
file in your website. This solved the issue for me.
Checkout if KB 2023146 applies to your scenario. Also try requesting directly a controller action: /yoursitename/home/index
Apparently this can have many different causes.
For us, the problem was that the DNS entry was configured for two IP addresses, but the IIS configuration would only listen to one of them. So we got unpredictable results, sometimes it would work, sometimes a few files (css, etc) would not load, and sometimes the whole page would not load.
For me it was all about installing .NET Framework 4.6.1 on the server (my app was targeting that version)
You'll also get this if your bindings aren't correct. If you don't have www or a subdomain it'll return a 404.
I had this problem when running my MVC4 site with an app pool set to ASP.NET 4.0 and the Classic pipeline, even though the extension handlers were set in my web.config and were showing correctly in IIS. The site worked in Integrated Pipeline so I knew it was a configuration issue, but I couldn't nail it down. I finally found that ASP.NET 4 was disabled for the server in the ISAPI and CGI Restrictions settings. I enabled ASP.NET 4.0 and it worked.
In addition to checking if you're running in integrated pipeline mode, make sure your application pool is set to use .NET! I recently ran into this problem, and when I went in to check the app pool settings, I found that somehow it had been set to "No Managed Code." Whoops!
My Hosting company fixed this for me by doing this (I removed the original password value of course).
<system.webServer>
<security>
<authentication>
<anonymousAuthentication password="<password>" />
</authentication>
</security>
</system.webServer>
Typically I encounter this issue when there is a Routing problem. I compare a working vs non-working to resolve it.
Today however I accidentially created a Virtual Directory in IIS.
It has to be an Application, right click on the Virtual Directory (with a folder icon) -> Convert to Application:
Don't use runAllManagedModulesForAllRequests. You want to let IIS handle resources such as images.
<system.webServer> <!-- Rather do NOT use this -->
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
Instead add the MVC routing module
<system.webServer>
<modules>
<remove name="UrlRoutingModule-4.0" />
<add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
</modules>
</system.webServer>

IIS cannot serve pages ending with .config

This is obviously a security issue and probably do not want to change this, but it would be nice to handle the error. Any ideas?
I see that stackoverflow is not immune:
https://stackoverflow.com/questions/tagged/web.config
They seem to have changed the tag to web-config to fix the problem but you still get a very nasty error message when you search for [web.config]
I believe this has been addressed in ASP.NET 4 with the addition of a new web.config setting
<configuration>
<system.web>
<httpRuntime relaxedUrlToFileSystemMapping="true"/>
</system.web>
</configuration>
Phil Haack has more details.
In IIS 7, this can be found under Request Filtering. Other extensions that are filtered by default include:
.asax
.ascx
.master
.cs
.csproj
etc.
It's not a bug BTW, because the request gets filtered before ASP.NET gets a chance to process it. In other words, you could remove the request filter and have IIS process the extension if you want to, but make sure the extension is handled by ASP.NET and not the static file handler.
Edit: Maybe the answer for SO would be to change it so that when tags have a .XXX extension like web.config, they change to web-config or something else that IIS doesn't filter. This probably also would be a good topic on https://meta.stackoverflow.com/

Placing a web.config file in a view directory

I am having the standard issue timeout exception in my production environment whereby, after 90 seconds, the thread will be killed. For the vast majority of my site this isn't a problem.
However, my sitemap generator is an exception to the rule.
Because it relies on the routes created in the application, I have chosen to create it inside the project, as it loads all routes in from the app, and then, effectively uses a customised Html.Action to generate each route.
Because it takes a fair while to create the entire sitemap (5 minutes at last count), I get a YSOD before it has a chance to complete. Now, in webforms, I'd just create a web.config in the directory, and a nice little handler for that page using the location element:
<configuration>
<location path="sitemapgenerator">
<system.web>
<httpRuntime executionTimeout="600" /><!-- Ten minutes -->
</system.web>
</location>
</configuration>
Without actually creating this config file, I'm convinced that, not only will this not work, but it's also pretty bad practice in MVC anyway, because it then restricts the naming of the sitemap generator to whatever is set in the config file, and not just the routes.
I could just ensure that the routes and the config file stay up-to-date if I need to change it, but this just seems messy in MVC.
Can anyone give me any suggestions about this, and whether this web.config method will work out?
Many thanks in advance.
Update: I've done a test on this, and no, it does not work, so I have no fallback solution either. :)
Have you tried setting the scriptTimeout property in the initialization of the site map generator?
Server.ScriptTimeout = 600;

Resources