Prevent root web.config to be overriden by a sub web.config - asp.net

I have 2 web.config files at root/ and at root/Web. I want that when I hit /Root/Web my application should load a certain set of settings from the root/Web.Config even though they are present in /root/web/Web.config
Any ideas where and what should I be modifying?

Yes, the way to do that is removing the elements in sub web.config that conflict with the settings in the root web.config.
If you need them for other purposes then you need to read whatever settings you want/need and apply them programmatically.
From MSDN:
The root of the ASP.NET configuration hierarchy is a file referred to
as the root Web.config file, and it is located in the same directory
as the Machine.config file. The root Web.config file inherits all of
the settings in the Machine.config file. The root Web.config file
includes settings that apply to all of the ASP.NET applications that
run a specific version of the .NET Framework. Because each ASP.NET
application inherits default configuration settings from the root
Web.config file, you need to create Web.config files only for settings
that override the default settings.

Related

How to configure Custom Http Module at Directory level?

I created a custom http module and want to add this module to the web config. The web application is a project that contains several "sub applications". A sub application is just a folder, and within that folder it has its own web.config. I'm doing this so each application has its own application related contents.
Now I created a custom http module. When adding this to the root web.config, the module is working properly. When adding the http module config to the directory-level web.config (e.g. /Applications/MyApplication/web.config) the module is not initialized anymore.
This is the root config which is working fine.
<httpModules>
<add name="MyFirstHttpModule" type="CustomModule.CustomModule,CustomModule" />
</httpModules>
Kindly help
ASP.net configuration already supports configuration inherance. You just have to add a new web.config in the specified folder.
ASP.NET website's Web.config is part of an inheritance chain. Your website's subfolders can have Web.config. This allows for setting general settings at the site level and overriding them when necessary. Any settings in the base Web.config that aren't overridden in the subfolder stay in effect, so the "child" Web.config can be pretty small. You can continue to nest them, so sub-sub-subfolders can get their own Web.config if needed.
A good example is the Web.config file in an ASP.NET MVC application's View folder which does things like preventing directly viewing the View templates
You can read more here.
If a request is received for a file in the SubDir1 directory that does
not exist, ASP.NET begins to search the configuration hierarchy,
starting at the most local Web.config file (which is located in the
current directory, if it exists, or a parent directory). ASP.NET is
searching for an error Element for customErrors (ASP.NET Settings
Schema) element where the statusCode attribute equals "404". Once
ASP.NET finds the configuration setting for the 404 error, the URL in
the redirect attribute is returned as the response.

What file extensions are blocked by default in IIS

Some files are not served off of IIS because they are typically part of the building blocks of the website itself. For ASP.NET these are files like *.cs, *.dll, *.config, *.cshtml, etc.
You can find a list of them tied up in the IIS management setting "Filter requests" here:
But if you need to programmatically access this list, it seems tough to find. Is there a good list of these default extensions?
BTW, the IIS website has info on how to enable / disable these globally here:
http://www.iis.net/configreference/system.webserver/security/requestfiltering/fileextensions
If I'm not mistaken, you'll find them in the root web.config of the machine:
%windir%\Microsoft.NET\Framework\framework_version\CONFIG
Which is also where you'll find the machine.config file.
e.g.
<add path="*.ascx" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
REF:
Technet: working with config files
KB: Use ASP.NET to Protect File Types
As to how you'd programmatically get to it - I haven't tried. The IIS_USRS built-in group has access to it and this doc expands on it.
Hth...
Here's the list I build out of the IIS UI since I couldn't find it anywhere. Hope you find it helpful.
disallowed extensions
.asax
.ascx
.master
.skin
.browser
.sitemap
.config
.cs
.csproj
.vb
.vbproj
.webinfo
.licx
.resx
.resources
.mdb
.vjsproj
.java
.jsl
.ldb
.dsdgm
.ssdgm
.lsad
.ssmap
.cd
.dsprototype
.lsaprototype
.sdm
.sdmDocument
.mdf
.ldf
.ad
.dd
.ldd
.sd
.adprototype
.lddprototype
.exclude
.refresh
.compiled
.msgx
.vsdisco
.rules
on localhost you can alter the applicationHost.config file, a systems file that you can edit in VS and go to the requestFiltering section, change and save.

Web.Config files and locations

We have a whole bunch of websites with very similar web.config files.
Can you centralise the duplicate configs in 1 config file before the root directory of each website? Or is the only option machine.config?
We are looking to centralise an assembly reference in the GAC.
Structure:
Containing Directory
Website 1 Directory
Website 2 Directory
Website 3 Directory
Web.Config File for all above sites
I have not encountered a way to have inherited config files besides machine.config, app/web.config and user.config levels. But you can use configSource attribute on all config sections (ConfigurationSection based) to include a common file for example with service endpoints, client endpoints, bindings, connection strings and others. Even though VS intellisense marks it as unsupported it does work.
<configuration>
<system.serviceModel>
<services configSource="Services.config" />
<client configSource="Client.config" />
<bindings configSource="Bindings.config" />
<behaviors configSource="Behaviors.config" />
</system.serviceModel>
<pages configSource="pages.config"/>
</configuration>
Config source files must be in application's folder or any folder below. No going up or absolute paths. But there is a trick to overcome this limitation in VS2010. You need to add an existing file as a link and change its property named "Copy to Output Directory". This way your absolute path file will get copied to your application folder from where you can reference it in configSource.
In previous versions of VS it is also possible but in a less elegant way - copy file in post build event.
If you are looking mainly to centralize WCF settings there is another option: in-code configuration. Huge advantage of this is you get compilation-time check and refactoring support from VS. If this does not sound like much I can assure you that in a bigger WCF project, config file management is a nightmare especially when you need to change something. With this approach it is also very easy to centralize WCF settings by just creating a common assembly where all services, endpoints, bindings etc. are defined. Disadvantage is that you loose possibility to change WCF settings without recompilation. But if those settings do not change very often it is a tempting alternative.
You can use the web.config located in
%SystemRoot%\Microsoft.NET\Framework\<versionNumber>\CONFIG\Web.config
Or if in IIS you configure your Containing directory as a main web site and then put your website directories as applications, you can put the web.config in the main web site to have the structure you mention.

ASP.NET application in virtual folder uses web.config of application in root folder of website

I have several ASP.NET applications in virtual folders (already configured as applications, and with different application pools), but I want to install another ASP.NET application that will redirect to one of the virtual folders according to some criteria (from database and cookies).
All the applications in the virtual folders work fine, but if I install the root application, then I get some errors about duplicate web.config settings.
A workaround would be to create yet another virtual folder for the redirecting application, and use HTML redirection on the root site.
However, I would like to know if it is possible for a web application in a virtual folder to skip the website-root web.config in the .config hierarchy.
Thanks,
Luis Alonso Ramos
One option is to move all the settings of the web.config to a location path where you use the inheritInChildApplications attribute so that those settings are only applied for the parent application and not child applications, something like:
<location inheritInChildApplications="false">
... move all your settings here...
</location>

why authentication mode="Forms" in subfolder is not supporting?

In our project we have many folders.I have authenticate my folder separately,without the help of root web.config.because web.config is always update by x person.i need all my control to a separate folder.
When i am trying to changing the "authentication mode" to root web.config,its working .but not in the subfolder, it is not working in my subfolderfolder web.config.
My question is : can web.config permission is associated to particular folder?
,without the help of root config?if not why it is not possible?(looking for the theory)
You can override the root web.config by putting a new web.config under your own subdirectory, or defining a <location> element to the root web.config.

Resources