I've got a WCF service which swallows up exceptions thrown in called methods and passing them on to the client. This is fine for DEBUG mode, and I've got a feeling I turned this functionality on, but how do you turn it off?
Any help much appreciated.
Check the includeExceptionDetailInFaults attribute of the serviceDebug element in the web.config file for your service. Setting this attribute to "false" should prevent exception details from being returned to the client.
<behaviors>
<serviceBehaviors>
<behavior name="httpsBehavior">
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="false" />
</behavior>
</serviceBehaviors>
</behaviors>
Related
When I enter the address of my service, I get to see the WSDL file. However, When I add a suffix to the URL, I get the error message: "endpoint not found". It's definitely due to something wrong with my service model declaration but after a few hours, I'm inclined to admit that it's beyond me.
I've made sure that the namespaces are correct as discussed here.
The first URL works. The other, don't.
http://---.azurewebsites.net/MyService.svc/
http://---.azurewebsites.net/MyService.svc/Ping
http://---.azurewebsites.net/MyService.svc/Ping/ (as suggested here)
In behaviors I've declared two behaviors - one for the end point and one for the service.
<behaviors>
<endpointBehaviors>
<behavior name="PingEndPointBehavior">
<webHttp/>
</behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name ="PingServiceBehavior">
<serviceMetadata httpGetEnabled="true"
httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
<behavior name="">
<serviceMetadata httpGetEnabled="true"
httpsGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
</serviceBehaviors>
</behaviors>
I declared the following binding for access via URL line in the browser.
<bindings>
<webHttpBinding></webHttpBinding>
</bindings>
In services I declared two end points (I tested with only the first one, as well).
<service name="MyProject.MyService"
behaviorConfiguration="PingServiceBehavior">
<endpoint name="PingEndPoint"
behaviorConfiguration="PingEndPointBehavior"
address="Ping"
binding="webHttpBinding"
contract="MyProject.IMyService"/>
<endpoint contract="IMetadataExchange"
binding="mexHttpBinding"
address="mex" />
</service>
I also have the following in my config file. Doubtful of its significance, but one never knows.
<serviceHostingEnvironment aspNetCompatibilityEnabled="true"
multipleSiteBindingsEnabled="true"/>
I've resolved the issue. Apparently, the virtual path of sub-directories is cumulative, so the exposed service was there all along but at the following address.
http://---.azurewebsites.net/MyService.svc/Ping/Ping
One ping level comes from the config file while the other from the template URI in the attribute that decorates the interface for the method.
I do have the problem that if I try to start the Project with the WCF Service as the Startpage I get the following Message:
Failed to add a service. Service metadata may not be accessible. Make sure your service is running and exposing metadata.
the configuration file as the following
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="">
<serviceMetadata httpGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true"/>
I have created wcf service and planning to make it accessible from the internet. The page 'You have created a service' seems to be some stub which should be replaced before putting service on production. Is it a bad practice to have this welcome page on production? What do you do with that welcome page when you publish wcf services on the internet?
Thanks
On production you can turn off this page by adding:
<behaviors>
<serviceBehaviors>
<behavior name="ProductionService">
<serviceDebug includeExceptionsInDetail="false" httpHelpPageEnabled="false" />
</behavior>
<serviceBehaviors>
</behavirs>
Also think about publishing WSDL / Metadata. If you don't want to publish WSDL but you want to use mex endpoint use following configuration:
<behaviors>
<serviceBehaviors>
<behavior name="ProductionService">
<serviceMetadata httpGetEnabled="false" />
<serviceDebug includeExceptionsInDetail="false" httpHelpPageEnabled="false" />
</behavior>
<serviceBehaviors>
</behavirs>
Your services must use those behavior in their behaviorConfiguration attribute.
Yes, it's bad. It says potential attackers that the system is non-configured completely, so they would try to attack it. Also, it's not very professional.
Well, print something useful there or hide it:-)
Recently I have been asked in an interview as how to pass exception detail to client
without using FAULT CONTRACT.
I was not able to answer.
But I need to know it. So looking forward to hear about the same.
I guess they asked you for this:
<behavior>
<serviceBehaviors>
<behavior name="ExceptionBehavior">
<serviceDebug includeExceptionDetailsInFaults="true" />
</behavior>
</serviceBehaviors>
</behavior>
Is it possible to control throttling on callback? So the server would be limited(controlled) how often it can callback the client.
yes.. there is a way you can define the max limit of users...
you can add max no of concurrent calls, instances and sessions.
Sample config...
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="Throttling">
<serviceThrottling maxConcurrentCalls="2" maxConcurrentInstances="2" />
<serviceThrottling />
</behavior>
</serviceBehaviors>
</behaviors>
</system.serviceModel>