Question

I have an ASP.NET 4.0 MVC web application running on IIS 6.0 with a webconfig custom error section of:

<customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="/Home/Error">
  <error statusCode="403" redirect="/Home/Error"/>
  <error statusCode="404" redirect="/Home/Error"/>
</customErrors>

and an error.aspx page that looks like this:

<%@ Page Title="" Language="C#" MasterPageFile="~/Views/Shared/Site.Master" Inherits="System.Web.Mvc.ViewPage<System.Web.Mvc.HandleErrorInfo>" %>

<%@ Import Namespace="System.Security.Cryptography" %>
<%@ Import Namespace="System.Threading" %>

<asp:Content ID="Content1" ContentPlaceHolderID="TitleContent" runat="server">
    Error
</asp:Content>

<asp:Content ID="Content2" ContentPlaceHolderID="MainContent" runat="server">

    <h2>Error Processing your request.</h2>

</asp:Content>

<asp:Content ID="Content3" ContentPlaceHolderID="Scripts" runat="server">
    <script runat="server">
       void Page_Load() {
          byte[] delay = new byte[1];
          RandomNumberGenerator prng = new RNGCryptoServiceProvider();

          prng.GetBytes(delay);
          Thread.Sleep((int)delay[0]);

          IDisposable disposable = prng as IDisposable;
          if (disposable != null) { disposable.Dispose(); }
        }
    </script>
</asp:Content>

Whenever i include the above “redirectMode=”ResponseRewrite”” in the webconfig custom errors section the redirect to my custom errors page no longer works and i get the page error of “Server error in “/” application – resource cannot be found”. In fact the controller action is ignored as well. When i take that setting our everything works as it should. I am trying to incorporate Scott Gu’s workaround for the Asp.net securtiy vulnerability listed here: http://weblogs.asp.net/scottgu/archive/2010/09/18/important-asp-net-security-vulnerability.aspx

Any help would be greatly appreciated.
Thanks,
Billy

Answer 1

Unfortunately, you cannot have any <error> tags within the <customErrors> block according to Scott Guthrie. They are definitely working on a patch, but in the mean time, you have to use a very simple <customErrors> section like the following:

<customErrors mode="On" redirectMode="ResponseRewrite" defaultRedirect="~/error.aspx" />