<httpRuntime requestValidationMode="2.0" /> doesn't work (using IIS 6.0) - asp.net

I'm getting errors with an application on our test web server, which has .NET 4.0 installed, when I input HTML into a form. I get the usual errors of:
A potentially dangerous Request.Form value was detected from the
client
This is being caused by the change in .NET 4.0 that disables switching off automatic validation for HTML input. I can fix this on my local development machine by adding the
<httpRuntime requestValidationMode="2.0" />
directive to the <system.web> section of my root web.config, and .NET then honours the <pages validateRequest="false" /> directive that's in the same root web.config. Strangely, I needed to restart IIS on my local machine (which is version 5.1) for this change to work.
When I deploy the root web.config to our test server however, I'm still getting the validation errors. I've tried using run > iisreset, stopping and starting IIS (which is version 6.0 on the test server), and I've even restarted the server to fully clear out .NET. My application is definitely picking up the new root web.config (I've tested this), however the <httpRuntime requestValidationMode="2.0" /> directive seems to just be ignored.
My application is configured as a .NET 4.0 application on both my local machine and on the test server. I've tried rebuilding the application and redeploying it to the test web server. Can anyone suggest what I need to do to get this working?
Thanks in advance, Chris

If you are using MVC3, Try adding a global filter in Global.asax.cs.
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new ValidateInputAttribute(false));
}

Related

ASP.NET Core Razor Pages project - An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode

HTTP Error 500.24 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.
Most likely cause:
system.web/identity#impersonate is set to true.
I am trying to run a newly created asp.net core razor pages web application on my local machine and I when I try to run my application using IIS Express I get this internal server error.
If I change the profile to use WebApplication1 instead of IIS Express, then it works fine.
UPDATE
I added this to the applicatoinhost.config
(C:\Users\psj\Desktop\test\WebApplication1.vs\WebApplication1\config) file and it seems to be working ok now with IIS express.
<system.web>
<identity impersonate="false"/>
</system.web>
But i'm still not sure why I have to add this to the applicationhost.config file in order to make it work.. Why isn't this done by default?
I was able to resolve this problem.
The problem was in my root web.config file [C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config] it had:
<identity impersonate="true"/>
Once I commented that out .. it worked fine.
Just posting this here in case anybody else runs in to this problem...

Simple ASP.NET Razor page on local IIS 8.5 - 500.19 0x8007000d error

I've built sample Razor webpage that works perfectly fine and I decided to deploy it on local IIS enabled on Windows 8.1. (IIS 8.5).
I used the publish feature through the file system that copied relevant files to Inetpub subfolder.
When I try to access the webpage I get this error:
The requested page cannot be accessed because the related configuration data for the page is invalid.
Error Code: 0x8007000d
Config Error:
Config File: (correct path)
The webconfig is suspiciously short but given simplicity of the page - perhaps long enough?
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<handlers>
<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified" />
</handlers>
<aspNetCore processPath="dotnet" arguments=".\myapp.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" />
</system.webServer>
</configuration>
I made pretty thorough search of similar issues here and other google-returned materials and overall nothing helped.
I'm pretty sure all relevant components that I could install for IIS I have installed already.
All configuration files are correctly formed.
The security is fine - I can play with webconfig content and get different error a bit which indicate IIS can access the config file.
The only thing that surprises me is that sometimes when I access various config icons on IIS for the page I get error like this:
i.e. for .NET Profile:
There was error while performing this operation.
Details: (nothing written here)
Filename: \?\C:\inetpub\wwwroot\mypagefolder\web.config
Error: (nothing written here)
Is my web.config missing some sections?
EDIT: I also dropped the published application on some other IIS server that is used for other applications and the result is the same which make me inclined to believe s.t. is either wrong with the application publish process or s.t. is very weird
Looking at your web.config, it is found that you are trying to deploying ASP.NET Core website. It requires
.NET Core Hosting Bundle installed on the hosting server
Application Pool .NET CLR version set to "No Managed Code"
Ensure that the Application Pool Identity user has read permissions on the published folder.
For details check:
https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/iis/?view=aspnetcore-2.0
First thing I suggest is to check is the .NET CLR version of your application pool and also check the AppPool Identity has read permissions on the published folder
I had the same issue in Windows 2012 Server. Although I had the SDK 2.1 installed, it only worked when I installed Runtime & Hosting Bundle.
https://www.microsoft.com/net/download/dotnet-core/2.1
It's important to mention that, in order to see this option, I had to click on "Can't find the file you want? Find more in .NET Core 2.1 downloads.".
By default this page is not shown.

WCF IIS Error 403

I am reading the book WCF 4.0 Multi-tier Services Development and tried implementing a simple Hello World with WCF using IIS.
I have a HelloWorldService project and a HostDevServer project (Startup Project). I should see a directory listening with two files but instead I get the next error message:
HTTP Error 403.14 - Forbidden
The Web server is configured to not list the contents of this directory.
Most likely causes:
A default document is not configured for the requested URL, and directory browsing is not enabled on the server.
What I have done:
Enabled Directory Browsing in IIS manager
Checked if I had Default Documents, they were present.
Run command: appcmd set config /section:system.webServer/directoryBrowse /enabled:true
In the about screen in IIS it says version 7.5 and in the browser it says "IIS 8.0 Detailed error ...". I don't know if this has something to do with the problem.
I use Visual Studio 2013 for development. Web.config below:
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
Does anyone know how to solve this problem?
I suspect you try to host the WCF as it was hosted with the self-host - under an extensionless uri.
This won't work. WCF services are hosted under *.svc activators. The extension informs IIS that it should find a proper host factory and create the service.
I added the website to the IIS manager and now it is working. I did need to edit permissions to acces the files but now i can acces the page without problems.
Should have read further in the book because they also explain about *.svc activators later.

httpModules URL rewriter works on Visual Studios Dev Server, but not on IIS 7.5

In my web.config, I have a custom Url rewriter class that takes query strings such as /movies/godzilla.aspx and turns it into /template.aspx?id=1234
The rewriter works fine when I run it locally on the built in web server in Visual Studios, but when I put it on IIS 7.5 and try to access the page using the friendly name, I get a message saying the connection was reset and have to do an iisreset to get the site back online. The page is perfectly accessible from the server using the query string URL.
Here is a snippet of my web.config:
<system.web>
<httpModules>
<add name="ApFriendlyURL" type="FriendlyURL" />
</httpModules>
....
</system.web>
I'm confused as to why this works when running on the Dev Server in Visual Studios but not on IIS. I've played around with the settings in IIS, but I can't seem to find anything that would let me use the FriendlyURL class as the rewriter
HTTP modules in IIS 7.5 have to be configured in the system.webServer/modules section. Just copy your module definition there.
http://msdn.microsoft.com/en-us/library/aa347531(VS.90).aspx
Please be aware of the possible problem with the duplicate module configuration. If this is so, you turn off the integrated mode configuration:
http://www.iis.net/ConfigReference/system.webServer/validation
If you are working on .NET 2.0 application you should enable "Integrated mode" in your AppPool setings.

Getting 404.0 error for ASP.NET MVC 3 app on IIS 7.0 / Windows Server 2008

I am attempting to deploy an ASP.NET MVC 3 application to a Windows 2008 x64 server (running IIS 7.0 obviously), and IIS does not want to seem to serve up the content properly. All requests are resulting in a 404.0 error, because the requests are not matching any handler and IIS is attempting to use the StaticFile handler to serve up the requests. The issue seems to be related to .NET 4.0, as I have an MVC 2 application running just fine in an app pool that is configured for the .NET 2.0 runtime.
I have had no issues deploying this same application to IIS 7.5 servers both on Windows 7 and Windows Server 2008 R2.
Prior to deployment, the 2008 server did not have .NET 4.0 or ASP.NET MVC 3 installed, so here are the steps I undertook prior to deploying the application:
Installed .NET 4.0
Ran aspnet_regiis.exe (from the Framework64/v4.0.30319 folder)
Installed ASP.NET MVC 3 using the web platform installer
Applied MS update KB980368 to enable certain IIS 7.0 or IIS 7.5 handlers to handle requests whose URLs do not end with a period
Requests to static resources in the application (JavaScript files, images, etc) go through without a hitch, but any request to an MVC action fails with a 404.0 error. I have noticed that IIS is using the StaticFile handler to handle these requests, which is obviously incorrect. The ASP.NET 4.0 handlers (i.e. ExtensionlessUrl-ISAPI-4.0* handlers) are properly defined as far as I can tell, so I have no idea why/how the request would not be handled by one of these handlers and would fall all the way down to the StaticFile handler.
I also came across the following MS knowledge base article which mentions that you should ensure HTTP Redirection and Static Content Compression are enabled/installed on the server where you are experiencing the 404 errors. I checked, and both features were already enabled for my server. I even tried removing and reinstalling the features to no avail.
At this point I am completely out of ideas for why this is not working properly. I have been able to replicate the issue on 2 different IIS 7.0 servers. What am I missing?
You actually just reminded me that I needed to fix this issue in an enviroment here. If your situation is the same as mine then it's a simple fix.
Just add the following to your web config:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true" />
Edit: To provide further explanation on the issue at hand. In my case what was happening was when I added custom route mappings IIS was seeing the requests as Folder/Static File requests and thus was skipping over the ASP.NET worker process. This behaves differently under development environment generally because it is being run under the development web server which will also pass all requests through the .net process.
This Web Config entry tells IIS that you have modules that should be run on every web request even if IIS determines it to be a static file or a folder.
Please make sure that you are running under IIS 7.0 Integrated mode. If you need to run it under IIS 7.0 Classic mode, you need to perform several actions to make the routes work. Please refer the following blog posts;
http://www.tugberkugurlu.com/archive/running-asp-net-mvc-under-iis-6-0-and-iis-7-0-classic-mode---solution-to-routing-problem
http://www.tugberkugurlu.com/archive/deployment-of-asp-net-mvc-3-rc-2-application-on-a-shared-hosting-environment-without-begging-the-hosting-company
The issue ended up being that my code was completely relying on the auto-start functionality that is available only in IIS 7.5. I was able to discover the issue with the help of the Failed Request Tracing feature in IIS, and I have now modified my global.asax.cs file so that the application will be properly initialized, regardless of how/when it is loaded.
My solution, after trying EVERYTHING:
Bad deployment, an old PrecompiledApp.config was hanging around my deploy location, and making everything not work.
My final settings that worked:
IIS 7.5, Win2k8r2 x64,
Integrated mode application pool
Nothing changes in the web.config - this means no special handlers for routing. Here's my snapshot of the sections a lot of other posts reference. I'm using FluorineFX, so I do have that handler added, but I did not need any others:
<system.web>
<compilation debug="true" targetFramework="4.0" />
<authentication mode="None"/>
<pages validateRequest="false" controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID"/>
<httpRuntime requestPathInvalidCharacters=""/>
<httpModules>
<add name="FluorineGateway" type="FluorineFx.FluorineGateway, FluorineFx"/>
</httpModules>
</system.web>
<system.webServer>
<!-- Modules for IIS 7.0 Integrated mode -->
<modules>
<add name="FluorineGateway" type="FluorineFx.FluorineGateway, FluorineFx" />
</modules>
<!-- Disable detection of IIS 6.0 / Classic mode ASP.NET configuration -->
<validation validateIntegratedModeConfiguration="false" />
</system.webServer>
Global.ashx: (only method of any note)
void Application_Start(object sender, EventArgs e) {
// Register routes...
System.Web.Routing.Route echoRoute = new System.Web.Routing.Route(
"{*message}",
//the default value for the message
new System.Web.Routing.RouteValueDictionary() { { "message", "" } },
//any regular expression restrictions (i.e. #"[^\d].{4,}" means "does not start with number, at least 4 chars
new System.Web.Routing.RouteValueDictionary() { { "message", #"[^\d].{4,}" } },
new TestRoute.Handlers.PassthroughRouteHandler()
);
System.Web.Routing.RouteTable.Routes.Add(echoRoute);
}
PassthroughRouteHandler.cs - this achieved an automatic conversion from http://andrew.arace.info/stackoverflow to http://andrew.arace.info/#stackoverflow which would then be handled by the default.aspx:
public class PassthroughRouteHandler : IRouteHandler {
public IHttpHandler GetHttpHandler(RequestContext requestContext) {
HttpContext.Current.Items["IncomingMessage"] = requestContext.RouteData.Values["message"];
requestContext.HttpContext.Response.Redirect("#" + HttpContext.Current.Items["IncomingMessage"], true);
return null;
}
}
If you are running your web application on IIS 7.5 or above, please ensure that the role services for IIS are enabled properly. The role services of interest are : ASP.NET, Basic Authentication, HTTP Redirection, ISAPI filters, etc.
You could go to the role services via Add or Remove programs - Turn Windows features on or off.
Hope this helps.
Regards,
Kiran Banda
I had the same problem. Mine ended up being a failed assembly upon the app starting. I enabled the Fusion Log Viewer to see which assemblies were failing and figured it out. I would have never discovered this since it seemed like an MVC routing issue, but I figured I would post this incase anyone else wasted hours on this problem as well!

Resources