, it still does not redirect to ErrorMessage.htm, which is a simple htm file that can't throw an asp.net server side error. When I view source after requesting PageThatThrowsApplicationException.aspx, the html contains
causes the same behavior for PageThatThrowsApplicationException.aspx. However, when I go to PageThatDoesNotExist.aspx the browser is sent the default 404 page specified in IIS. If I navigate directly to ErrorMessage.aspx there is no error.
I previously stripped out the Exception Management Application Block code that used to be there, so at this point I don't have any custom error handling.
I just created a new web application named TestCustomError and it works as expected with the recommended customError tag. The page that throws an exception redirects as it should to ErrorMessage.aspx. Navigating to pages that don't exist also redirects to
ErrorMessage.aspx.
I replaced TestCustomError/web.config with the web.config from the application that isn't working, and TestCustomError still works.
I replaced web.config on the application that isn't working with the original web.config that worked in TestCustomError, and it still doesn't work.
Do you have a Global.asax file or are you using a load balancer or WAF? Any of those things could be coming into play. Also, is there any difference in ASP.NET config between this app and the test app in IIS?
The problem application has Global.asax, but the code behind file has only the standard method signatures; they don't execute any code. TestCustomError does not have Global.asax. I'm not using a load balancer or WAF.
On my development machine in IIS, TestCustomError got created as a virtual directory, whereas the problem app is a web application. On our test server they are both web apps, and the symptoms are the same on both machines. I compared all of the tabs in
IIS and can't find any difference. I compared permissions and found that the problem app didn't grant ASP.NET read permission while TestCustomError did, but granting it didn't solve the problem.
lp9999
Member
6 Points
10 Posts
customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 01:08 PM|LINK
IIS 6, Windows 2003 Server.
Web.config: <customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/ErrorMessage.htm" />
http://mysite/mywebapp/PageThatDoesNotExist.aspx - IIS log has status 200. Redirects to ErrorMessage.htm as expected.
http://mysite/mywebapp/PageThatThrowsApplicationException.aspx - IIS log has status 200, but no redirect occurs so the response html is different. I assume this would allow the exploit.
What am I missing?
Thanks.
oracle padding Vulnerability
mehta.rahuli...
Contributor
2208 Points
718 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 01:17 PM|LINK
http://stackoverflow.com/questions/781861/customerrors-does-not-work-when-setting-redirectmoderesponserewrite
MCAD
Contributor Award 2011
lp9999
Member
6 Points
10 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 01:45 PM|LINK
Thanks for the response. If I remove
, it still does not redirect to ErrorMessage.htm, which is a simple htm file that can't throw an asp.net server side error. When I view source after requesting PageThatThrowsApplicationException.aspx, the html containswhich tells me the server responded with the html of the page that threw the exception rather than the html of ErrorMessage.htm.
I'm using IIS6 so
is not available. There is no master page or global.asax error handling.oracle padding Vulnerability
owjeff
Member
136 Points
37 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 02:19 PM|LINK
Are you using ASP.NET 3.5 SP1? If so, redirect to an aspx page.
OrcsWeb: Managed Windows Hosting Solutions
"Remarkable Service. Remarkable Support."
lp9999
Member
6 Points
10 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 02:32 PM|LINK
Thanks owjeff, I am using 3.5 SP1. Using this:
or
causes the same behavior for PageThatThrowsApplicationException.aspx. However, when I go to PageThatDoesNotExist.aspx the browser is sent the default 404 page specified in IIS. If I navigate directly to ErrorMessage.aspx there is no error.
owjeff
Member
136 Points
37 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 02:40 PM|LINK
Do you have any custom error handlers?
OrcsWeb: Managed Windows Hosting Solutions
"Remarkable Service. Remarkable Support."
lp9999
Member
6 Points
10 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 03:23 PM|LINK
I previously stripped out the Exception Management Application Block code that used to be there, so at this point I don't have any custom error handling.
I just created a new web application named TestCustomError and it works as expected with the recommended customError tag. The page that throws an exception redirects as it should to ErrorMessage.aspx. Navigating to pages that don't exist also redirects to ErrorMessage.aspx.
I replaced TestCustomError/web.config with the web.config from the application that isn't working, and TestCustomError still works.
I replaced web.config on the application that isn't working with the original web.config that worked in TestCustomError, and it still doesn't work.
This seems to rule out web.config.
owjeff
Member
136 Points
37 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 03:34 PM|LINK
Do you have a Global.asax file or are you using a load balancer or WAF? Any of those things could be coming into play. Also, is there any difference in ASP.NET config between this app and the test app in IIS?
OrcsWeb: Managed Windows Hosting Solutions
"Remarkable Service. Remarkable Support."
lp9999
Member
6 Points
10 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 04:11 PM|LINK
The problem application has Global.asax, but the code behind file has only the standard method signatures; they don't execute any code. TestCustomError does not have Global.asax. I'm not using a load balancer or WAF.
On my development machine in IIS, TestCustomError got created as a virtual directory, whereas the problem app is a web application. On our test server they are both web apps, and the symptoms are the same on both machines. I compared all of the tabs in IIS and can't find any difference. I compared permissions and found that the problem app didn't grant ASP.NET read permission while TestCustomError did, but granting it didn't solve the problem.
lp9999
Member
6 Points
10 Posts
Re: customErrors does not redirect when ApplicationException occurs
Sep 22, 2010 06:20 PM|LINK
Success, thanks to the good questions you asked. Look at the code I was running in the test page that was intentionally throwing the exception:
Dim ex as new applicationexception("testing")Microsoft.ApplicationBlocks.ExceptionManagement.ExceptionManager.Publish(ex)
Doh!
Originally I was using
Throw New ApplicationException("testing"), and I had forgotten that I put the ExceptionManager code back in.Thanks for your time and patience.