How to prevent "aspxerrorpath" being passed as a query string to ASP.NET custom error pages

Question

In my ASP.NET web application, I have defined custom error pages in my web.config file as follows:

<customErrors mode="On" defaultRedirect="~/default.html">
     <error statusCode="404" redirect="~/PageNotFound.html" />
</customErrors>

In the case of a 404 error, my site redirects to the default.html page, but it passes "aspxerrorpath" as a query string parameter to the custom error page as follows:

http://www.example.com/default.html?aspxerrorpath=/somepathcausederror/badpage.aspx

I don't want that behavior. I want the redirect URL to simply read:

http://www.example.com/default.html

Is there a way to achieve this?

score 73 · Answer 1 · answered Apr 08 '11 at 17:06

73

If you supply your own query string variable when specifying the path, then .NET will NOT tack on the "aspxerrorpath". Who knew?

For example:

<customErrors mode="On" defaultRedirect="errorpage.aspx?error=1" >

This will do the trick. I had to add this to a bunch of apps since URLScan for IIS by default rejects anything with "aspxerrorpath" in it anyway.

answered Apr 08 '11 at 17:06

Matt J.

1,780
1
14
17

1

If you supply your own query string variable, How can you make .net add "aspxerrorpath" to the QueryString you give ? – whitestream Jul 19 '12 at 08:18
25

Worth mentioning that all you actually need to do is add a "?" to the end to prevent the aspxerrorpath parameter being added. So just: `` will do the trick – Stelloy Jun 25 '13 at 13:40
Problem with this is, it still sends a status code 302, THEN redirects to the 404 page which is (or should be) status code 404 – mnsr Apr 28 '15 at 06:21
@jzm just add `Response.StatusCode = 404;` to the page load method (ASPX) or controller method (MVC) of the 404 page – jaybro Apr 05 '17 at 20:56

score 12 · Answer 2 · answered Feb 18 '14 at 14:19

In the global.asax, catch the 404 error and redirect to the file not found page. I didn't require the aspxerrorpath and it worked a treat for me.

void Application_Error(object sender, EventArgs e)
{
    Exception ex = Server.GetLastError();
    if (ex is HttpException && ((HttpException)ex).GetHttpCode() == 404)
    {
        Response.Redirect("~/filenotfound.aspx");
    }
    else
    {
        // your global error handling here!
    }
}

score 6 · Answer 3 · answered Oct 29 '13 at 19:58

6

You could just send your own url params to the error page

<customErrors mode="On" defaultRedirect="~/default.html?404"> 
               <error statusCode="404" redirect="~/PageNotFound.html?404" /> 
</customErrors>

answered Oct 29 '13 at 19:58

Shak18

61
1
1

score 2 · Answer 4 · answered Dec 11 '14 at 18:19

2

I use javascript like

if (location.search != "") { window.location.href = "/404.html"; }

answered Dec 11 '14 at 18:19

Diogo Cid

3,764
1
20
25

score 2 · Accepted Answer · answered Nov 19 '10 at 07:48

2

My first thought would be to create a HttpHandler which catches url's with aspxerrorpath in it, and strips it. You could probably do the same with the rewrite module in IIS7 as well.

answered Nov 19 '10 at 07:48

Mikael Svenson

39,181
7
73
79

score 2 · Answer 6 · answered Nov 19 '10 at 09:14

2

I think you'd instead implement/use the Application_Error event in Global.asax, and do your processing/redirects there.

Providing you call Server.ClearError in that handler, I don't think it will use the customErrors config at all.

answered Nov 19 '10 at 09:14

Damien_The_Unbeliever

234,701
27
340
448

Thanks Demien issue is we still need customErrors config it seems its not possible to control in web.config this behavior(aspxerrorpath query string completely removal) – DSharper Nov 19 '10 at 10:12

score 1 · Answer 7 · answered May 18 '16 at 14:42

1

If you remove aspxerrorpath=/ and you use response redirect during error handling you'll get exception there will be redirection loop.

answered May 18 '16 at 14:42

Pawel

887
1
9
28

score 1 · Answer 8 · answered Jul 19 '19 at 09:36

1

Add redirectMode="ResponseRewrite" in the Custom Error like this,

<customErrors mode="On" defaultRedirect="~/NotFound">
     <error statusCode="404" redirect="~/NotFound" redirectMode="ResponseRewrite"/>
</customErrors>

this solution works for me.

answered Jul 19 '19 at 09:36

Raji

171
11

score 0 · Answer 9 · answered Nov 16 '18 at 10:39

The best solution (more a workaround..) I implemented since now to prevent aspxerrorpath issue continuing to use ASP.NET CustomErrors support, is redirect to the action that implements Error handling.

These are some step of my solution in an ASP.NET MVC web app context:

First enable custom errors module in web.config

<customErrors mode="On" defaultRedirect="~/error/500">
  <error statusCode="404" redirect="~/error/404"/>
</customErrors>

Then define a routing rule:

routes.MapRoute(
   name: "Error",
   url: "error/{errorType}/{aspxerrorpath}",
   defaults: new { controller = "Home", action = "Error", errorType = 500, aspxerrorpath = UrlParameter.Optional },
);

Finally implement following action (and related views..):

public ActionResult Error(int errorType, string aspxerrorpath)
{
   if (!string.IsNullOrEmpty(aspxerrorpath)) {
      return RedirectToRoute("Error", errorType);
   }

   switch (errorType) {
      case 404:
           return View("~/Views/Shared/Errors/404.cshtml");

       case 500:
        default:
           return View("~/Views/Shared/Errors/500.cshtml");
    }
}

score 0 · Answer 10 · answered Nov 12 '19 at 12:05

In my case, i prefer not use Web.config. Then i created code above in Global.asax file:

protected void Application_Error(object sender, EventArgs e)
    {
        Exception ex = Server.GetLastError();

        //Not Found (When user digit unexisting url)
        if(ex is HttpException && ((HttpException)ex).GetHttpCode() == 404)
        {
            HttpContextWrapper contextWrapper = new HttpContextWrapper(this.Context);

            RouteData routeData = new RouteData();
            routeData.Values.Add("controller", "Error");
            routeData.Values.Add("action", "NotFound");

            IController controller = new ErrorController();
            RequestContext requestContext = new RequestContext(contextWrapper, routeData);
            controller.Execute(requestContext);
            Response.End();
        }
        else //Unhandled Errors from aplication
        {
            ErrorLogService.LogError(ex);
            HttpContextWrapper contextWrapper = new HttpContextWrapper(this.Context);

            RouteData routeData = new RouteData();
            routeData.Values.Add("controller", "Error");
            routeData.Values.Add("action", "Index");

            IController controller = new ErrorController();
            RequestContext requestContext = new RequestContext(contextWrapper, routeData);
            controller.Execute(requestContext);
            Response.End();
        }
    }

And thtat is my ErrorController.cs

public class ErrorController : Controller
{
    // GET: Error
    public ViewResult Index()
    {
        Response.StatusCode = 500;
        Exception ex = Server.GetLastError();
        return View("~/Views/Shared/SAAS/Error.cshtml", ex);
    }

    public ViewResult NotFound()
    {
        Response.StatusCode = 404;
        return View("~/Views/Shared/SAAS/NotFound.cshtml");
    }
}

And that is my ErrorLogService.cs

//common service to be used for logging errors
public static class ErrorLogService
{
    public static void LogError(Exception ex)
    {
        //Do what you want here, save log in database, send email to police station
    }
}

score 0 · Answer 11 · answered Dec 15 '20 at 17:15

If you want to resolve or handle error request you can insert into Handler try catch statement. like this:

try {
  //  Block of code that generate error
}
catch(Exception e) {
  //  Block of code to handle errors ||| HERE you can put error in your response and handle it without get xhr redirect error.
}

How to prevent "aspxerrorpath" being passed as a query string to ASP.NET custom error pages

11 Answers11

Linked