1

My ASP .Net website's web.config is configured as

  <system.web>
   .....
    <customErrors mode="RemoteOnly">
      <error statusCode="500" redirect="/500/" />
    </customErrors>

  <system.webServer>
    ....
    <httpErrors>
      <remove statusCode="400" subStatusCode="-1" />
      <remove statusCode="401" subStatusCode="-1" />
      <remove statusCode="403" subStatusCode="-1" />
      <remove statusCode="404" subStatusCode="-1" />
      <remove statusCode="500" subStatusCode="-1" />
      <error statusCode="400" path="/404/" responseMode="Redirect" />
      <error statusCode="401" path="/404/" responseMode="Redirect" />
      <error statusCode="403" path="/404/" responseMode="ExecuteURL" />
      <error statusCode="404" path="/404/" responseMode="ExecuteURL" />
      <error statusCode="500" path="/500/" responseMode="ExecuteURL" />
    </httpErrors>

I test a 404 page and my friendly error page displays but when i add < to the URL which i believe returns a 400 response i just get the YSOD (Yellow screen of death) instead of the expected friendly page?

What have i missed off?

Computer
  • 2,149
  • 7
  • 34
  • 71
  • I've tried to fix this for ages with no luck. I get a server 404 though, not the ysod. Test with debugging off, not that it will fix it. – wazz May 16 '20 at 02:41
  • Your right it won't fix it as it just gives the error.... – Computer May 18 '20 at 06:13

1 Answers1

0

Adding ‘<’ to the URL causes the Dotnet Code error, which can be captured by the custom error feature.

<customErrors mode="On" defaultRedirect="/MyError1.html" redirectMode="ResponseRedirect">
    <error statusCode="400" redirect="/MyError400.html" />
    <!--<error statusCode="401" redirect="/MyError2.html" />
    <error statusCode="403" redirect="/MyError2.html" />
    <error statusCode="404" redirect="/MyError2.html" />
    <error statusCode="500" redirect="/MyError2.html" />-->
  </customErrors>

On my side, I usually combine the custom error feature with the http error feature to handle the errors since both the IIS and DotNet code may throw an exception. It also can avert the YSOD. 

<customErrors mode="On" defaultRedirect="/MyError1.html" redirectMode="ResponseRedirect">
    <error statusCode="400" redirect="/MyError400.html" />
    <!--<error statusCode="401" redirect="/MyError2.html" />
    <error statusCode="403" redirect="/MyError2.html" />
    <error statusCode="404" redirect="/MyError2.html" />
    <error statusCode="500" redirect="/MyError2.html" />-->
  </customErrors>
  </system.web>
  <system.webServer>
    <httpErrors errorMode="Custom" existingResponse="Auto">
      <remove statusCode="400" />
      <remove statusCode="401" />
      <remove statusCode="403" />
      <remove statusCode="404" />
      <remove statusCode="500" />
      <error statusCode="400" path="MyError.html" responseMode="File" />
      <error statusCode="401" path="MyError.html" responseMode="File" />
      <error statusCode="403" path="MyError.html" responseMode="File" />
      <error statusCode="404" path="MyError.html" responseMode="File" />
      <error statusCode="500" path="MyError.html" responseMode="File" />
    </httpErrors>
  </system.webServer>

Result.
enter image description here
For more details.
What is the difference between customErrors and httpErrors?
Feel free to let me know if there is anything I can help with.

Abraham Qian
  • 7,117
  • 1
  • 8
  • 22