Creating a custom error for error 403.14 Denying directory access

Question

This is my first post here, and I have been looking for a solution to this problem here and in many other forums on the Internet without success.

I am trying to create a custom error for accessing a directory that forbade 403.14 errors in cases where it is said that someone is trying to upload the "_assests" directory to a website. I know that I can do the job by adding the default.aspx page to every directory I want this to happen to, but I wondered if there was a site-level solution similar to the tag in the web.config file.

<configuration> <system.web> <customErrors defaultRedirect="/Errors/GenericError.aspx" mode="RemoteOnly"> <error statusCode="401" redirect="/Errors/401.aspx"/> <error statusCode="403" redirect="/Errors/403.aspx"/> <error statusCode="404" redirect="/Errors/404.aspx"/> <!-- <error statusCode="403.14" redirect="/"/> --> </customErrors> </system.web> </configuration> 

I get an error while encoding web.config that I cannot use statusCode with a decimal point in it, because it is not an Int data type

I have IIS 7 on a 2008 server.

Any ideas?

Answer 1

Perhaps you could use a redirect approach based on the actual error code with Server.GetLastError() .

In Global.asax , you will have something like this:

 protected void Application_Error(object sender, EventArgs e) { if (Context.IsCustomErrorEnabled) { ShowCustomErrorPage(Server.GetLastError()); } } 

ShowCustomErrorPage will have a switch statement that reads the HTTP code and redirects to the correct error page.

More from the original link, but this may be too specific to MVC. Since you did not mention that you use MVC, I did not want to assume blindly copy-paste.

I am not very familiar with MVC, but the principles here look so that they can be adjusted according to your scenario.

Source: http://www.digitallycreated.net/Blog/57/getting-the-correct-http-status-codes-out-of-asp.net-custom-error-pages

Edit

Found a couple of StackOverflow posts that might help too:

Custom error handling in web.config / Global.asax does not handle a nonexistent directory

Custom error handling Asp.Net

Answer 2

Sorry in advance if this sounds pretty confusing. Glad to make it clear.

The following has been added to web.config : it still works. I don’t know why, but if I do not explicitly indicate 403 errors to redirect to the 403.aspx user page, instead of the GenericError.aspx page, I get a 500 error. However, if I redirect 404 errors to my 404.aspx user page, the 404.aspx code GenericError.aspx written in place and not as expected, and it seems like you never redirected to the actual 404.aspx page (see the commented part of web.config ) Bizarre

CODE:

Web.config file:

 <system.webServer> <httpErrors existingResponse="Replace" errorMode="Custom"> <remove statusCode="403"/> <remove statusCode="404"/> <error statusCode="403" path="/Errors/403.aspx" responseMode="Redirect" /> <!-- <error statusCode="403" path="/Errors/GenericError.aspx" responseMode="Redirect" /> --> <!-- <error statusCode="404" path="/Errors/GenericError.aspx" responseMode="Redirect" /> --> <error statusCode="404" path="/Errors/404.aspx" responseMode="Redirect" /> </httpErrors> </system.webServer> 

GenericError.aspx.cs

 protected void Page_Load(object sender, EventArgs e) { var ex = HttpContext.Current.Server.GetLastError(); if (ex is HttpException) { var nex = ex as HttpException; //Label in the Main code displays the Error Code from the Error String this.customErrorMessageCode.Text += "Error Code" + " " + nex.GetHttpCode().ToString(); //Label in the Main code displays the Error Message from the Error String this.customErrorMessageLabel.Text += ex.Message.ToString(); //DIV ID in the Main code displays the entire error message this.customErrorMessage.Visible = true; switch (nex.GetHttpCode()) { case 404: this.customErrorMessageCode.Text += " Page Not Found"; this.customErrorMessageImage.Visible = true; // do somehting cool break; case 403: this.customErrorMessageCode.Text += " Forbidden Access"; this.customErrorMessageImage.Visible = true; // do somehting cool break; case 500: this.customErrorMessageCode.Text += " Internal Error"; this.customErrorMessageImage.Visible = true; // do somehting cool break; default: break; } } else { this.customErrorMessageLabel.Text += ex.Message + ex.GetType().ToString(); } } 

A source:

CustomError in web.config