URL /%20/ throws configuration file error with external connectionStrings or appSettings files - asp.net-mvc-4

Had some pen testers test an ASP.NET MVC4 site, and they found I was showing a "raw" error with the URL: /%20/ e.g. https://example.com/%20/
Server Error in '/' Application.
Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.
Parser Error Message: The configSource file 'Web_ConnectionStrings.config' is also used in a parent, this is not allowed.
Source Error:
Line 17: <!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
Line 18: <!-- these settings can be found in external files - this prevents application restart when they are changed -->
Line 19: <connectionStrings configSource="Web_ConnectionStrings.config" />
Line 20: <appSettings configSource="Web_AppSettings.config" />
Line 21: <!-- xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx -->
Although it should be, this isn't a normal 404 error, I already catch those and display a custom page. I also catch 500's and display them nicely too. This error happens earlier than the Application_Error() in global.asax.cs so it's not caught there.
This seems to be caused by the slash-space-slash confusing IIS or the application, and it's trying to load the web.config's include files more than once or something.
If I include those sections the normal way (not external files - just normal XML sections in the web.config) then everything works as expected and the custom 404 page shows.
If you removed the %20 and just do two slashes, everything works fine. It seems like it has to be this specific URL.
I've seen other posts about IIS configuration with Default Site or virtual paths pointing to the same file location. But I don't think that applies, as I have the Default Site stopped, and I don't see any problems on any other URLs - the site seems to be working fine.
Does anyone know what IIS is trying to do with a /%20/ URL? Or how to handle this more gracefully?
I like having these config sections split out so changes don't recycle the app pool, but if this is a problem with doing this (why are external files allowed then?) then I guess I'll bring all the settings into the web.config itself.

Related

ASP.NET Core hosting - 500 internal server error

I am trying to publish as ASP.NET Core project with a hosting provider that supports ASP.NET Core. I am getting 500 Internal Server Error which I believe is very common. So I searched through the internet and various forums and then I checked the processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" in web.config and they look to be correctly converted with processPath="dotnet" and arguments=".\MyApplication.dll".
I also checked the connection string and it points to production DB server that's working. I confirmed the DB connection by changing the connection string to production DB and running project local. It works and I get the production DB access.
I also tried to get the error info by using the below in my Startup.cs (irrespective of env):
app.UseDeveloperExceptionPage();
app.UseDatabaseErrorPage();
app.UseBrowserLink();
I have also enabled stdoutLog in web.config, but I don't see that folder either:
stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout"
I also tried to change applicationUrl and launchUrl in launchSettings.json to my prod Url, but that didn't work as well.
So, the 500 Internal Server Error refuses to go away, and I still don't have a useful error message. The page just says:
Oops.
500 Internal Server Error
An error occurred while starting the application.
I would really appreciate if someone could help me here.
I have also enabled stdoutLog in web.config as but I don't see that folder either:
stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout"
There is one trick here - you must create both folders logs and stdout manually - then and only then IIS will create log file inside logs folder (not stdout as you could expect) - don't ask me why, because I don't know why ;)
Oops. 500 Internal Server Error An error occurred while starting the application.
Usually, means problems with a configuration in Startup.cs - the most common problems include an issue with DB itself, an issue with migrations (if you are using Code First approach), problems with appsettings.js, problems with Social Logins credentials (like missing SecretKey)...
Please refer to log file in .\logs\stdout - this is the quickest way to find details about the problem :)
app.UseDeveloperExceptionPage();
app.UseDatabaseErrorPage();
Those will work after your WebApp fully started, but not while starting the application.
in web.config file change modules="AspNetCoreModuleV2" to modules="AspNetCoreModule"
and watch this video
https://www.youtube.com/watch?v=clCR3k6kkD8
Thanks to Lukasz for his comments. I was able to see the log and it stated that "ClientId option must be provided". The problem was with the UserSecrets. Since secrets.json is only available in Development, there were no secrets found in Production. Once I had the secrets in my appSettings.json, it worked fine.
Moreover, To replicate this in Local environment, just go to Project properties and change the environment variable ASPNETCORE_ENVIRONMENT to 'Production' and run in local. This will replicate the 500 Internal Server Error in local and you'll get the error message.
Also, ensure that the ASP.NET Core Windows Server Hosting bundle is installed. THis creates a reverse proxy between IIS and the Kestral server.
More Info:
https://learn.microsoft.com/en-us/aspnet/core/publishing/iis?tabs=aspnetcore2x#tabpanel_tfsY37MhAQ_aspnetcore2x
I would like to add some more info to #Lukasz Makowej answer.
I found out the reason why to have to create the folder, in microsoft documentation it is said that:
stdoutLogFile - Optional string attribute.
".....Any folders provided in the path must exist in order for the module to create the log file...."
So you have to create it yourself :)
Check it out here:
https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/aspnet-core-module?view=aspnetcore-2.0
I also must said that in my case I had to validate that the web-site had the permissions to access to the "log" folder.
Make sure your web.config is good. I've been stomped more than once by a syntactically good web.config that referred to a module (Rewrite) that wasn't on the server. No error messages anywhere, other than the 500 response error.
Std log wasn't working for me, I had to uninstall all .ENT Core runtime / SDK versions from the server and my local to install the latest one and it worked after publishing everything again from scratch.
Another thing that helped was binding the IIS app to port 5000 without any dns so it actually showed me errors on http://localhost:5000
Encountered this issue yesterday, we also had no logging, no eventlog message whatsoever.
Then we checked the site's authentication settings via the IIS-manager to double-check the settings. And pop suddenly a popup with an error message 'Error on line XXXX'.
Turned out the configuration section was locked in the website's config at server-level.
So try unlocking the relevant IIS configuration settings at server level, as follows:
Open IIS Manager
Select the server in the Connections pane
Open Configuration Editor in the main pane
In the Sections drop down, select the section to unlock, e.g. system.webServer => security => authentication
Click Unlock Attribute in the right pane
Repeat for any other settings which you need to unlock
Restart IIS (optional) - Select the server in the Connections pane, click Restart in the Actions pane

Can't show embeded pdf file from own server

If i test this in my localhost the file it's embeded like it's expected, but once that the server goes public this message shows up in the console:
Load denied by X-Frame-Options:
http://x.x.x.x/app/resources/pdf/somePDf.pdf does not permit framing.
That file is stored in the same server so i'm not violating the cross origin.
i load the file with angular, but then again loading it with angular it's not the problem.
What is the cause of the problem?
Edit:
I added to the spring security 4 file these lines:
<headers>
<frame-options policy="SAMEORIGIN" />
</headers>
Still not working as intended.
NOTE: Turns out it's only a firefox thing, chrome and explorer are working fine.

AppHarbor Isn't overwriting my local RavenDB entry

When I publish my app to appHarbor, I receive the following errors when I visit my app page and disable custom errors. It's complaining about lines in the Web.config file:
the entry ravendb has already been added
It's annoying to have to go in and "prep" my web.config and app.config each time I publush. Isn't it supposed to over-write whatever values I put in there?

Hosting a WCF Service

So i am new to WCF Services and I need to create a dulplex service (working on it) however I cannot figure out where/how to host it (external). Right now I am using http://aspspider.com for my hosting, which works fine, but i am having trouble geting a wcf service application working.
I found this example which i will be using to help get my service working. I tried to just upload the service to aspspider, but i get an error.
Configuration Error Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.
Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.
Source Error:
Line 29: ASP.NET to identify an incoming user.
Line 30: -->
>>>Line 31: <authentication mode="Windows"/>
Line 32: <!--
Line 33: <customErrors> section enables configuration
The service works fine locally, so i just need help to get it working on aspspider (or if you have a better option).
I use Station5.net as my host and never had any issues with them.

500.19 internal server error

I am currently trying to add Blogengine to a web page. I have used web platform installer. when I try to view the blog it gives me this error.
Module IIS Web Core
Notification Unknown
Handler Not yet determined
Error Code 0x80070005
Config Error Cannot read configuration file due to insufficient permissions
Config File \\?\c:...\httpdocs\web.config
Requested URL http://..../Blog/
Physical Path
Logon Method Not yet determined
Logon User Not yet determined
I have given read permisions to the web.config file but it still doesn't run