IIS 7 Error Codes

Question

I'm running a Sitefinity CMS website on IIS 7. I'm seeing a couple of weird results when I'm trying to return a 404 status.

If I go to a URL like:

www.mysitefinitywebsite.com/test.co.uk (I realise this is an invalid address, but someone entered it into the CMS)

As the above is not an ASPX page, I believe IIS handles the error, with the following code:

    <httpErrors errorMode="Custom">
        <remove statusCode="404" subStatusCode="-1" />
        <error statusCode="404" prefixLanguageFilePath="" path="/404.aspx" responseMode="ExecuteURL" />
    </httpErrors>

The url in the address bar remains the same, my custom 404 page (/404.aspx) page is displayed, however a http status code 200 is returned.

If however the following url is typed in:

www.mysitefinitywebsite.com/test.aspx - the ASPX error handler kicks in with the following config:

<customErrors mode="On" >
    <error redirect="~/Sitefinity/nopermissions.aspx" statusCode="403" />
    <error redirect="~/404.aspx" statusCode="404" />
</customErrors>

Again, my custom 404 page is displayed, however the url in the address bar changes to:

www.mysitefinitywebsite.com/404.aspx?aspxerrorpath=/test.aspx

And strangely if I check Firebug, a 302 code is returned for text.aspx and then a status of 200 for /404.aspx?aspxerrorpath=/test.aspx.

I don't completely understand whats going on here, it seems like IIS isnt responding with the status code at all - is this by design? Seems completely crazy!

If it is by design, presumably the only way to resolve it is to programatically return the correct response code?

Thanks in advance higgsy

Answer 1

When you use the <httpErrors> element and using executeUrl , you are serving dynamic content. If that content doesn't explcitly return the status code (an asp.net, asp, etc page) you need to set the existingResponse attribute to auto/replace/passthrough as you see fit.

The intent here is the web server can have a generic error and you may want to return a different or extended error code to your clients. This makes more sense for APIs where you might want a 404 to contain/return more info about what wasn't found, etc, etc.

Take a look at the IIS.NET documentation on httpErrors for the existingResponse flag

http://www.iis.net/ConfigReference/system.webServer/httpErrors

---

As for ASP.NET, a 302 redirect on error is default behavior, which is what you see. The 404 is returned b/c the page you are redirecting to is programmatically setting the status code of the response.

The difference is simply causing by handling. In the first you are allowing IIS to handle the error before executing the ASP.NET pipe. In the second, IIS passes off to the ASP.NET pipeline. They are two different techs, hence the two difference behaviors. Rest assured with a little research you can make them both do the same.