David
Thu Mar 20 04:27:36 CDT 2008
Detailed custom errors for customers is a fatal security flaw. This is
why detailed errors are restricted to local by default.
IIS7 allows configuration of static custom error pages for 401, 403,
404, etc, though not all HTTP status codes (like 400, 411, 503, etc)
because HTTP.SYS returns them without telling IIS about it.
My advice is to just configure your custom errors using static pages.
Your desire to reveal server configuration to customers is insecure.
You can easily customize the 500 error page to send your support staff
the detailed email and a simple apology to the customer -- that is far
more secure than dumping the error to the customer and hope they tell
you about it.
FYI: it is possible for applications on top of IIS to send "custom
error pages" which are not caught by the IIS custom error page handler
(for example, application that send its own 404 Not Found page but
sets the HTTP status as 200). Those applications deliberately fool IIS
(and your attempts to customize its error pages).
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//
On Mar 19, 2:17=A0am, "Fancy Fan" <Fancy...@community.nospam> wrote:
> Hi WenJun and all,
>
> Thanks for your help first!
> As you said, DetailedLocalOnly cannot achieve our requirement.
> I hope we can customize the content of specific error pages. For example, =
I
> need create a static error page for Error:404 not found instead of the
> default 404 error page. Also I need create a static error page for
> Error:403, 401. But the same time, I need keep default error page for
> Error:500 internal server errors so that customers can see the detail
> information about the error reasons. That means I want to find a way to
> define every error page for website, some in static, some in
> detail(default).
> The problem is once I customerize one error page( locate the "Error Pages"=
),
> I must choose display all error pages in this way. That's not convenient f=
or
> us. Do you have a better solution?
>
> Thank you so much!
>
> Fancy
>
> 19th Mar
>
> ""WenJun Zhang[msft]"" <wjzh...@online.microsoft.com> =D0=B4=C8=EB=CF=FB=
=CF=A2news:mUh$m71gIHA.1500@TK2MSFTNGHUB02.phx.gbl...
>
>
>
> > Hi Fancy,
>
> > The default setting of <httpErrors> section's errorMode attribute is
> > DetailedLocalOnly which means detailed error info will only be returned =
to
> > local accesses. Remote users will not see the detailed troubleshooting
> > info. Can't this achieve your requirement?
>
> > If not, please further clarify the exact problem you are looking for. Do=
> > you want to keep using the pages of Detailed Errors and need to
> > customize/remove some sensitive sections from them? The information in
> > default Custom error pages are not enough.
>
> > Am I understanding correctly on this?
>
> > Thanks and have a nice day.
>
> > Sincerely,
>
> > WenJun Zhang
>
> > Microsoft Online Community Support
>
> > Delighting our customers is our #1 priority. We welcome your comments an=
d
> > suggestions about how we can improve the support we provide to you. Plea=
se
> > feel free to let my manager know what you think of the level of service
> > provided. You can send feedback directly to my manager at:
> > msd...@microsoft.com.
>
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
> > Get notification to my posts through email? Please refer to
> >
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.asp...
> > ications.
>
> > Note: The MSDN Managed Newsgroup support offering is for non-urgent issu=
es
> > where an initial response from the community or a Microsoft Support
> > Engineer within 1 business day is acceptable. Please note that each foll=
ow
> > up response may take approximately 2 business days as the support
> > professional working with you may need further investigation to reach th=
e
> > most efficient resolution. The offering is not appropriate for situation=
s
> > that require urgent, real-time or phone-based interactions or complex
> > project analysis and dump analysis issues. Issues of this nature are bes=
t
> > handled working with a dedicated Microsoft Support Engineer by contactin=
g
> > Microsoft Customer Support Services (CSS) at
> >
http://msdn.microsoft.com/subscriptions/support/default.aspx.
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
> > This posting is provided "AS IS" with no warranties, and confers no
> > rights.- Hide quoted text -
>
> - Show quoted text -