IIS Overwriting HTTP Response Text When HTTP Response Status set as 400

Question

I am building an MVC 3 application with an IIS 7.5 backend. On my controller, I have action methods that allow the user to add/edit domain objects. The Action handles HTTP Post, has a return value of string which contains any validation error messages encountered during the save process. Here is an example of one Action Method:

    [HttpPost]
    public string CustomerEdit(CustomerModel customerModel)
    {
        var errorMessages = new StringBuilder();
        var serverErrors = new List<string>();

        //Map to a customer domain object
        Mapper.CreateMap<CustomerModel, Customer>();
        var customer = Mapper.Map<CustomerModel, Customer>(customerModel);

        if (customerModel.Oper == "del")
        {
            var customerIds = new List<Guid>();
            customerIds.Add(customer.Id);

            if (!_serverService.DeleteCustomers(customerIds))
            {
                errorMessages.Append("The item could not be deleted");
                Response.StatusCode = Constants.STATUS_SERVER_ERROR;
            }
        }
        else
        {
            //Validate
            if (!_serverService.ValidateCustomer(customer, out serverErrors))
            {
                foreach (var error in serverErrors)
                {
                    ModelState.AddModelError("Validation", error);
                }
            }

            //Save
            if (ModelState.IsValid)
            {
                var saveStatus = _serverService.SaveCustomer(ref customer, _id);

                if (!saveStatus)
                {
                    errorMessages.Append("The server encountered and error during Save");
                    Response.StatusCode = Constants.STATUS_SERVER_ERROR;
                }
            }
            else
            {
                errorMessages.Append(GetValidationErrors(ModelState));
                Response.StatusCode = Constants.STATUS_SERVER_ERROR;
            }
        }
        return errorMessages.ToString();
    }

In the case of an error, I need to set the Response.StatusCode property to a value of either 400/500, and return a concatenated string of detailed error messages. Unfortunately, IIS always strips my error string out of the response test, and (in the case of 400 errors) adds replaces it with the string 'Bad Request'

Is there a way to configure IIS to return a custom, Action-specific, string when the status code is set to 400?

https://stackoverflow.com/questions/268592/custom-error-page-configured-in-iis-for-code-400-bad-request-is-ignored/64915366#64915366 — Alexander Mihailov, Nov 19 '20 at 16:35

score 21 · Accepted Answer · edited Jul 11 '16 at 19:41

After talking to a friend of mine who is a wiz at configuring IIS, I found that in IIS 7+ you can add the following to web.config:

<system.webServer>
  <httpErrors errorMode="Detailed"/>
</system.webServer>

If this setting in web.config is used, AND you set the body of the response, then the response body will reach the client. If you do NOT set the response body, then IIS will serve up a detailed error page with detailed error information (see http://learn.iis.net/page.aspx/267/how-to-use-http-detailed-errors-in-iis/). Many folks consider this a security risk, so use with caution.

score 17 · Answer 2 · answered Jun 10 '13 at 14:42

17

In MVC it is also possible to do this on a Action by Action basis. See TrySkipisCustomErrors.

Use:

Response.TrySkipIisCustomErrors = true;
Response.StatusCode = (int)HttpStatusCode.BadRequest;
return this.Json(SomeJsonObject);  // could output string too

answered Jun 10 '13 at 14:42

jsturtevant

2,560
1
23
23

1

It helped me. I used it with status code 422 (not tried with 400) – Maxim Eliseev Dec 06 '13 at 10:29

score 3 · Answer 3 · edited Apr 19 '19 at 11:34

3

we ended up with going for

 <system.webServer>
     <httpErrors errorMode="Custom" existingResponse="PassThrough" />
 </system.webServer>

in the web.config. Which allowed custom errors that set status codes to leave IIS unmolested.

edited Apr 19 '19 at 11:34

Ferruccio

98,941
38
226
299

answered Nov 22 '16 at 15:51

rob

8,134
8
58
68

score 2 · Answer 4 · edited Jun 20 '20 at 09:12

2

At least the page Configuring HTTP Error Responses in IIS 7 says

Note

You cannot customize the following HTTP error messages: 400, 403.9, 411, 414, 500, 500.11, 500.14, 500.15, 501, 503, and 505.

EDIT: though in the responses of this question, which looks quite similar, there is a response claiming that at least something can be done with httpErrors configuration.

edited Jun 20 '20 at 09:12

Community

1
1

answered Jan 17 '12 at 19:36

eis

51,991
13
150
199

I have found a way to do this, please see my answer for details – TheoryOfLight Jan 19 '12 at 06:55
400 is already allowed for custom error pages (except the the 400 generated from the IIS Kernel in case of bad URL for example). Tested in IIS 10. – Alexander Mihailov Nov 19 '20 at 16:38

IIS Overwriting HTTP Response Text When HTTP Response Status set as 400

4 Answers4

Linked