We've added the following to our Web.config:
<system.webServer>
<security>
<requestFiltering>
<verbs allowUnlisted="false">
<clear/>
<add verb="GET" allowed="true"/>
<add verb="POST" allowed="true"/>
</verbs>
</requestFiltering>
</security>
</system.webServer>
When we do an Invoke-WebRequest with PowerShell for other verbs than GET and POST we get the message:
The remote server returned an error: (404) Not Found.
Does this mean the verb is disabled? Or is there a better way?
Related
I'm exploring HTTP verbs like LINK and UNLINK. There is a simple website on IIS 10 for this purpose but looks like it doesn't allow these methods by default. I added a couple of rules in Request Filtering for verbs and still getting 405 error.
UPD
web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<trace enabled="true" writeToDiagnosticsTrace="true" />
</system.web>
<system.webServer>
<security>
<requestFiltering>
<verbs>
<add verb="LINK" allowed="true" />
<add verb="UNLINK" allowed="true" />
</verbs>
</requestFiltering>
</security>
</system.webServer>
</configuration>
Hello so I'm pretty new to using IIS and Visual Studio but I've managed to launch one website on IIS but when I try to launch this one I get this error across the page:
Error message:
Cannot add duplicate collection entry of type 'mimeMap' with unique key attribute 'fileExtension' set to '.mp4'
There's a section that reads Config Error:so here is my web.config file:
<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="DetailLogging" value="True"/>
<add key="LoggingConfigFile" value="log4net.config"/>
<add key="DatabaseConnectionString" value="Integrated Security=True; MultipleActiveResultSets=True; Data source=.\SQLEXPRESS; Initial Catalog=WebEvaluation" />
<add key="Email" value="***********************"/>
<add key="SupportEmailID" value="*************************"/>
<add key="ForgotPasswordEmailSubject" value="Butterfly Scheme e-Certification Admin Console - Password Request"/>
<add key="WelcomeMailSubject" value="Butterfly Scheme e-Certification Admin Console"/>
<add key="PasswordChangedMailSubject" value="Butterfly Scheme e-Certification Admin Console - Password Changed"/>
<add key="PasscodeDeleteMailSubject" value="Passcode delete notification - "/>
<add key="Host" value="***********"/>
<add key="PortNo" value="25"/>
<add key="Password" value="***********"/>
<add key="SiteURL" value="***********************************"/>
<add key="RecordsPerPage" value="20" />
<add key="PasscodeCreateMailSubject" value="Butterfly Scheme e-Certification Passcode List created for : "/>
<add key ="XlsConnectionString" value="Provider=Microsoft.Jet.OLEDB.4.0;Data Source={0}; Extended Properties='Excel 8.0;IMEX=1'"/>
<add key ="XlsxConnectionString" value="Provider=Microsoft.ACE.OLEDB.12.0;Data Source={0}; Extended Properties='Excel 8.0;'"/>
</appSettings>
<system.web>
<compilation debug="true" targetFramework="4.0">
<assemblies>
<add assembly="System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=******************"/>
<add assembly="System.Web.Extensions.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=******************"/>
<add assembly="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
</assemblies>
</compilation>
<httpRuntime requestValidationMode="2.0" maxRequestLength="2097151"
executionTimeout="900"/>
<sessionState mode="InProc" timeout="20"/>
</system.web>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<staticContent>
<mimeMap fileExtension=".mp4" mimeType="video/mp4"/>
<mimeMap fileExtension=".m4v" mimeType="video/m4v"/>
<mimeMap fileExtension=".3gp" mimeType="video/3gpp"/>
</staticContent>
<security>
<requestFiltering>
<requestLimits maxAllowedContentLength="2147482624"/>
</requestFiltering>
</security>
</system.webServer>
</configuration>
You could add something like this:
<remove fileExtension=".mp4" />
Or, since the MP4 mime type seems to be already present in the roots configuration file, simply omit the whole line:
<mimeMap fileExtension=".mp4" mimeType="video/mp4"/>
If you really want to be sure that the extensions you seem to require are present, this could be a replacement for the staticContent tag:
<staticContent>
<remove fileExtension=".mp4" />
<remove fileExtension=".m4v" />
<remove fileExtension=".3gp" />
<mimeMap fileExtension=".mp4" mimeType="video/mp4"/>
<mimeMap fileExtension=".m4v" mimeType="video/m4v"/>
<mimeMap fileExtension=".3gp" mimeType="video/3gpp"/>
</staticContent>
Could not load type "PresentationLayer.Global"
Check if you namespace is PresentationLayer or is changed? If changed update it in the markup, by right clicking on Global.asax and select "View Markup"
I wanted to add some IIS requestFiltering rules to my web application. I followed folling guides:
http://www.iis.net/configreference/system.webserver/security/requestfiltering/alwaysallowedurls
http://www.iis.net/configreference/system.webserver/security/requestfiltering/denyurlsequences
For example, I want to deny Url test but enable testallowed
So I made following configuration in my web.config:
<system.webServer>
<security>
<requestFiltering>
<denyUrlSequences>
<add sequence="test" />
</denyUrlSequences>
<alwaysAllowedUrls>
<add url="testallowed" />
</alwaysAllowedUrls>
</requestFiltering>
</security>
</system.webServer>
Wenn calling mypage/test, I get the IIS HTTP Error 404.5 Page, which is correct. But I get the same page when calling mypage/testallowed. And in my web.config, the Tag alwaysAllowedUrls is underlined and it says:
The element 'requestFiltering' has invalid child element 'alwaysAllowedUrls'. List of possible elements expected: 'fileExtensions, requestLimits, verbs, hiddenSegments, denyUrlSequences'.
this is the syntax as per the IIS documentation :
<system.webServer>
<security>
<requestFiltering>
<denyUrlSequences>
<add sequence="bad" />
<add sequence="sequence" />
</denyUrlSequences>
<alwaysAllowedUrls>
<add url="/bad_sequence.txt" />
</alwaysAllowedUrls>
</requestFiltering>
</security>
</system.webServer>
https://www.iis.net/configreference/system.webserver/security/requestfiltering/alwaysallowedurls?showTreeNavigation=true
I still get the error even if I have increased the limits as shown below.
I am using vs2013, MVC5 and Windows 8.1
<system.web>
<httpRuntime maxRequestLength="1048576" executionTimeout="3600" />
</system.web>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxAllowedContentLength="1073741824" />
</requestFiltering>
</security>
<handlers>
<remove name="BlockViewHandler"/>
<add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
</handlers>
</system.webServer>
I am using URL rewriting with IHttpModule. Application work on local but on server application give error if I written path without extension (aspx).
I had register URL rewriting module in web config like
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<modules>
<add name="URLRewriteModule" type="URLRewriteModule" preCondition="ManagedHandler" />
</modules>
<defaultDocument>
<files>
<add value="Login.aspx" />
</files>
</defaultDocument>
</system.webServer>
And also ExtensionlessUrlHandler-Integrated-4.0, ExtensionlessUrlHandler-ISAPI-4.0_64bit, ExtensionlessUrlHandler-ISAPI-4.0_32bit handler are there. Then also I am getting following error
HTTP Error 500.0 - Internal Server Error
Module ManagedPipelineHandler
Notification ExecuteRequestHandler
Handler ExtensionlessUrlHandler-Integrated-4.0
Error Code 0x800703e9
I think you have miss a config.
The following is an example, custom http module should be configed both in system.web node and system.webserver node
<system.web>
<compilation debug="true" targetFramework="4.0" />
<httpModules>
<add name="CustomHttpModule" type="Routing_Static_Page_Demo.WebModule.CustomHttpModule, Routing_Static_Page_Demo" />
</httpModules>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true">
<remove name="UrlRoutingModule"/>
<add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule,
System.Web,
Version=4.0.0.0,
Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a" />
<add name="CustomHttpModule" type="Routing_Static_Page_Demo.WebModule.CustomHttpModule" />
</modules>