Is %HOMEDRIVE% valid in web.config? - iis

trying to add a handler to my web.config file, but using a windows variable doesn't work. How can I use %HOMEDRIVE% or something similar in the scriptProcessor attribute?
<handlers>
<remove name="PHP_via_FastCGI" />
<add name="PHP_via_FastCGI" path="*.php" verb="GET, PUT, POST, DELETE, HEAD, OPTIONS" modules="FastCgiModule" scriptProcessor="%HOMEDRIVE%\php\php-cgi.exe" resourceType="Either" requireAccess="Script" />
</handlers>

Solution is to use %SystemDrive% variable instead https://learn.microsoft.com/en-us/iis/configuration/system.webServer/#configuration-sample

Related

Enabling OPTIONS method on Azure Cloud Service (to enable CORS)

I am developing a public API using Azure API Management, which then calls service methods in my cloud service.
To allow other apps to use this API from a browser environment, I need to enable CORS in the cloud service. Enabling CORS involves handling OPTIONS requests which are sent by the browser as a pre-flight to check if the correct headers are set.
To make sure the OPTIONS request reaches my application I have had to make a few changes in my web.config:
<system.webServer>
<handlers>
<remove name="SimpleHandlerFactory-Integrated-4.0" />
<remove name="SimpleHandlerFactory-Integrated" />
<remove name="SimpleHandlerFactory-ISAPI-4.0_64bit" />
<remove name="SimpleHandlerFactory-ISAPI-4.0_32bit" />
<remove name="SimpleHandlerFactory-ISAPI-2.0-64" />
<remove name="SimpleHandlerFactory-ISAPI-2.0" />
<remove name="OPTIONSVerbHandler" />
<add name="OPTIONSVerbHandler" path="*" verb="OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="None" preCondition="bitness32" />
<add name="SimpleHandlerFactory-ISAPI-2.0" path="*.ashx" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv2.0,bitness32" responseBufferLimit="0" />
<add name="SimpleHandlerFactory-ISAPI-2.0-64" path="*.ashx" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v2.0.50727\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv2.0,bitness64" responseBufferLimit="0" />
<add name="SimpleHandlerFactory-ISAPI-4.0_32bit" path="*.ashx" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
<add name="SimpleHandlerFactory-ISAPI-4.0_64bit" path="*.ashx" verb="*" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
<add name="SimpleHandlerFactory-Integrated" path="*.ashx" verb="*" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv2.0" />
<add name="SimpleHandlerFactory-Integrated-4.0" path="*.ashx" verb="*" type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
. . .
</system.webServer>
This ensures that the OPTIONS calls reach my .ashx and .svc code in which I can then set the correct headers.
This all works fine locally when I call the services from another domain, for example using js fiddle.
However, when I upload my application to Azure, it no longer works. Any OPTIONS requests return a 404 immediately.
It seems that the handler definitions used to forward the OPTIONS requests to my applications do not work on Azure.
My question is: what do I need to configure to make sure OPTIONS requests reach my application and can be handled there on Azure?
In the end I ended up removing the handlers as in my question, but adding two custom handlers:
<remove name="SimpleHandlerFactory-Integrated-4.0" />
<remove name="SimpleHandlerFactory-Integrated" />
<remove name="SimpleHandlerFactory-ISAPI-4.0_64bit" />
<remove name="SimpleHandlerFactory-ISAPI-4.0_32bit" />
<remove name="SimpleHandlerFactory-ISAPI-2.0-64" />
<remove name="SimpleHandlerFactory-ISAPI-2.0" />
<remove name="OPTIONSVerbHandler" />
<!-- Added the following handlers -->
<add name="AshxHandler" path="*.ashx" verb="*"
type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified"
requireAccess="Script"/>
<add name="SvcHandler" path="*.svc" verb="*"
type="System.Web.UI.SimpleHandlerFactory" resourceType="Unspecified"
requireAccess="Script"/>
Another part of the answer was adding the OPTIONS operations in API Management.
Using the CORS policy of API Management as suggested by Miao Jiang actually did not work and in fact breaks CORS in my situation when I include it now.
I'm sure it will work for other situations though.
EDIT: I ended up using policies anyway, and it now works. No OPTIONS operations need to be added. I've used the following policy on API level:
<policies>
<inbound>
<base />
<cors>
<allowed-origins>
<origin>*</origin>
</allowed-origins>
<allowed-methods>
<method>GET</method>
<method>POST</method>
<method>OPTIONS</method>
</allowed-methods>
<allowed-headers>
<header>*</header>
</allowed-headers>
</cors>
</inbound>
<outbound>
<base />
</outbound>
</policies>
I had a similar issue with OPTIONS request on an Web API running on Azure. There was a simple fix available:
In the Azure Portal, click on your App Service to open the management interface.
Scroll down the list of management options until you reach the 'API' section, and click on 'CORS'
Either enter the web address of the allowed origin, or enter '*' to allow all, and click Save.

Web API 2 hosted in IIS 7.5 and Windows server 2008 R2 giving 403.14

There are many other questions similar to this in SO, i am still posting here because none of them are working out for my environment.
The exact error i am getting is,
HTTP Error 403.14 - Forbidden
The Web server is configured to not list the contents of this directory.
Enabling Directory browsing in IIS doesn't help at all.
Also tried adding adding all verbs in ExtensionLessUrlHandler-Integrated-4.0 in IIS Handler mappings.
And also tried removing module WebDAVModule and WebDAV handler in config as shown below.
<system.webServer>
<modules>
<remove name="WebDAVModule" />
</modules>
<handlers>
<remove name="WebDAV" />
</handlers>
</system.webServer>
Thanks in advance for your answers!
If anyone is still facing this issue, I got it resolved by adding the lines below in my config file:
<validation validateIntegratedModeConfiguration="false" />
<modules runAllManagedModulesForAllRequests="true" />
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>

Not able to access images folder inside a module

I have an Images folder inside my module. I have added a web.config to this folder.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<appSettings>
<add key="webpages:Enabled" value="false" />
</appSettings>
<system.web>
<httpHandlers>
<add path="*" verb="*" type="System.Web.StaticFileHandler" />
</httpHandlers>
</system.web>
<system.webServer>
<handlers accessPolicy="Script,Read">
<add name="StaticFile" path="*" verb="*" modules="StaticFileModule" preCondition="integratedMode" resourceType="File" requireAccess="Read" />
</handlers>
</system.webServer>
</configuration>
In the view file, I tried using img src=../Images/background.png, and full path resolves to this,
localhost:4126/OrchardLocal/Contents/Item/Images/background.png.
I tried to use this absolute url for image src, localhost:4126/OrchardLocal/ModuleName/Images/background.png, it still didn't work. I get the 404 error.
How to get this working?
Thanks.
You should never use a relative path from a view, as this won't be resolved server-side but client-side, relative to the current path and not to your view file. You can use #Href("~/Modules/ModuleName/Images/background.png") instead, which will get resolved server-side correctly.

How to use Glimpse in Orchard CMS

I'm new to Orchard CMS.
I want to use Glimpse in Orchard cms and config it as quick start, but when I go to http://localhost:30320/OrchardLocal/glimpse.axd it show error message "The resource cannot be found"
Anyone know how to resolve it, please show me. Thanks!
You need to modify the web.config in the Orchard.Web folder. If you installed Glimpse using NuGet, it added two settings to the web.config to tell the web server to use Glimpse to handle the glimpse.axd resource.
The problem is the Orchard.Web\web.config file's <httpHandlers> and <handlers> sections both include a catch all handler to block all resources by default, and the Glimpse settings get added after the catch alls. You just need to move the glimpse entries to appear before the catch alls.
In <httpHandlers> section, change from this:
<httpHandlers>
...
<add path="*" verb="*" type="System.Web.HttpNotFoundHandler" />
<add path="glimpse.axd" verb="GET,POST" type="Glimpse.Core.Handler" />
</httpHandlers>
to this:
<httpHandlers>
...
<add path="glimpse.axd" verb="GET,POST" type="Glimpse.Core.Handler" />
<add path="*" verb="*" type="System.Web.HttpNotFoundHandler" />
</httpHandlers>
Next, in <handlers> section, change from this:
<handlers accessPolicy="Script,Read">
...
<add name="NotFound" path="*" verb="*" type="System.Web.HttpNotFoundHandler" preCondition="integratedMode" requireAccess="Script" />
<add name="Glimpse" path="glimpse.axd" verb="GET,POST" type="Glimpse.Core.Handler,Glimpse.Core" preCondition="integratedMode" />
</handlers>
To this:
<handlers accessPolicy="Script,Read">
...
<add name="Glimpse" path="glimpse.axd" verb="GET,POST" type="Glimpse.Core.Handler,Glimpse.Core" preCondition="integratedMode" />
<add name="NotFound" path="*" verb="*" type="System.Web.HttpNotFoundHandler" preCondition="integratedMode" requireAccess="Script" />
</handlers>

IIS 7.5 + enable PUT and DELETE for RESTFul service, extensionless

i am trying to understand how IIS 7.5 handles POST and PUT request.
I am writing a RESTful service using OpenRasta framework. The POST operation works without any problem, but the PUT operation for the same URL does not. It returns error like the following
Detailed Error Information
Module: IIS Web Core
Notification: MapRequestHandler
Handler: StaticFile
Error Code: 0x80070002
the url is like this following "http://localhost/MyService/Resource.Something.manifest"
Same setup works fine in visual studio development IIS.
Solution
Basically the default ExtensionlessUrlHandler does not accept PUT and DELETE verb. Just need to add them.
<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
To get PUT and DELETE to be accepted by IIS 7.5 for a PHP 5.4 fast-CGI driven REST API I had to disable the WebDAV-module. Otherwise the WebDAV module intervenes the HTTP requests using PUT or DELETE. To get this working was however a bit confusing and I might have missed some steps or done it in another order.
These lines are placed as children of the <system.webServer>-element in web.config in the application root.
<modules>
<remove name="WebDAVModule" />
</modules>
<handlers>
<remove name="WebDAV" />
</handlers>
Hopes this might spare some frustration. It seems like the default setting for the server is to accept any HTTP verb not listed - see settings under Request filtering -> HTTP Verbs -> Edit feature Settings. One may consider to explicitly add the VERBS that are to be allowed. The verbs allowed may be specified appending this snippet, also as a child of <system.webServer>.
<security>
<requestFiltering>
<verbs allowUnlisted="false">
<add verb="GET" allowed="true" />
<add verb="POST" allowed="true" />
<add verb="DELETE" allowed="true" />
<add verb="PUT" allowed="true" />
</verbs>
</requestFiltering>
</security>
On a client machine one can uninstall the WebDAV module from here:
Control Panel -> Uninstall Program -> Turn Windows features on or off -> IIS -> World Wide Web Services -> Common HTTP feautre -> WebDAV Publishing
The last measure to get it working was by editing applicationhost.config found in C:\Windows\System32\inetsrv\config. Within <system.webServer> -> <handlers> you will see a php entry that has just verb="GET,HEAD,POST - amend it to add the verbs you require, e.g.:
<add name="PHP54_via_FastCGI" path="*.php" verb="GET,HEAD,PUT,DELETE,POST"/>
|
|
|
append verbs here ----------------------------------------------|
1.Go to IIS Manager.
2.Click on your app.
3.Go to "Handler Mappings".
4.In the feature list, double click on "WebDAV".
5.Click on "Request Restrictions".
6.In the tab "Verbs" select "All verbs" .
7.Press OK.
See http://learn.iis.net/page.aspx/901/iis-express-faq/ that is linked from the OR wiki.
From the link (not block-quoted for readability):
A: You can modify the IIS Express applicationHost.config in the %userprofile%\documents\IISExpress\config folder. For example to enable PUT and DELETE for extensionless Urls scroll down to the bottom of the IIS Express applicationHost.config file and look for a handler entry that starts with:
<add name="ExtensionlessUrl-Integrated-4.0" …
In the verb attribute add PUT and DELETE so the verb attribute looks like: verb="GET,HEAD,POST,DEBUG,PUT,DELETE".
My scenario was a web application in a web site on IIS 7.5. The web site had to continue to enable WebDAV, but the web application needed to turn it off in order to support PUT and DELETE in its REST API.
To get that working, the web application's Web.config needed this:
<modules runAllManagedModulesForAllRequests="true" runManagedModulesForWebDavRequests="true" >
<remove name="WebDAVModule" />
</modules>
<handlers>
<remove name="WebDAV" />
</handlers>
The important difference from the other answers here is the need for runManagedModulesForWebDavRequests="true"
For me this does the trick in the web.config.
<system.webserver>
<handlers>
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" modules="IsapiModule" scriptProcessor="c:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" resourceType="Unspecified" requireAccess="Script" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
<system.webserver/>
<system.web>
<authentication mode="Windows" />
<identity impersonate="true"/>
<system.web/>
I used following configuration:
IIS 7.5
Windows Server 2008 R2
Custom Application Pool, .NET 4.0, Integrated
Windows Authentication = true
Anonymous Authentication = false
Hope it helps. ;-)
URLScan tool users
If other answers still don't work and you get 404 error: these verbs may be explicitly rejected by the URLScan tool, if you have it installed.
You can configure [AllowVerbs] and [DenyVerbs] sections of the URLScan.ini file to meet your needs.
Beware of the security risks of enabling these verbs.
What worked for me was uninstalling WebDav completely.
Going into the handler mappings and setting WebDAV to handle all verbs is the only thing that worked for me, despite the fact that PUT and DELETE were already listed as handled verbs. The working web.config I have is:
<system.webServer>
<handlers>
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
<remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness32" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" responseBufferLimit="0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
<remove name="WebDAV" />
<add name="WebDAV" path="*" verb="*" modules="WebDAVModule" resourceType="Unspecified" requireAccess="None" />
</handlers>
</system.webServer>
in the web.config
<system.webServer>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>
you can also use the IIS management UI and define this globally, or default web server
I tried in IIS 8.
**uninstall WebDav Publishing
Steps to uninstall
-> Control Panel -> Go to Programs and features -> Turn windows
featues on or off-> Select Internet Information Services->World Wide
Web Services->Common HTTP Featues->"Remove" WebDAV Publishing by unchecking WebDAV option**
Reason for 500 error !
Hi all,
I want to post my own research too, I hope it would help future enthusiasts.
As suggested in answers, I can't uninstall WebDav so I have added the line below in web config (from other answers)
<system.webServer>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
</system.webServer>
but I got a 500 error, when I have enabled debug mode found this
Cannot add duplicate collection entry of type 'add' with unique key attribute 'name' set to 'ExtensionlessUrlHandler-Integrated-4.0'
Answer
Its because there was already an ExtensionlessUrlHandler in the handler mappings section, do the following to resolve the issue.
Method 1
1) Go to Your IIS Manager and select your app
2) Go to Handler Mappings feature
3) Find ExtensionlessUrlHandler-Integrated-4.0 and delete it.
4) Add ExtensionlessUrlHandler in your webconfig (as mentioned in above answers)
<system.webServer>
<handlers>
<remove name="ExtensionlessUrlHandler-Integrated-4.0" />
<add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="GET,HEAD,POST,DEBUG,PUT,DELETE" type="System.Web.Handlers.TransferRequestHandler" resourceType="Unspecified" requireAccess="Script" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
Method 2
1) Remove ExtensionlessUrl handler from your web config
2) Click on your app in IIS Server, go to HandlerMappings
3) Find ExtensionlessUrlHandler-Integrated-4.0 (only this name, ignore others)
4) right click on it and choose Edit
edit handler
5) click on 'Request Restrictions' and select Verbs tab & choose All Verbs
this will enable extensionsless handler to allow all verbs.
I will go with method 1, as we can have control in web.config. But make sure you
check the deployment server for duplicate handler definitions.
My web.config with asp.net core 1.0
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<modules>
<remove name="WebDAVModule" />
</modules>
<handlers>
<remove name="WebDAV" />
<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModule" resourceType="Unspecified"/>
</handlers>
<aspNetCore processPath="%LAUNCHER_PATH%" arguments="%LAUNCHER_ARGS%" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" forwardWindowsAuthToken="false"/>
</system.webServer>
</configuration>
In windows server 2012.
Open applicationHost.config file in notepad with Administrator rights
applicationHost.config file is found in C:\Windows\System32\inetsrv\config
Locate the section
<verbs allowUnlisted="false" applyToWebDAV="true">
<add verb="GET" allowed="true" />
<add verb="HEAD" allowed="true" />
<add verb="POST" allowed="true" />
<add verb="DELETE" allowed="false" />
<add verb="TRACE" allowed="false" />
<add verb="PUT" allowed="false" />
<add verb="OPTIONS" allowed="false" />
</verbs>
Notice DELETE and PUT HTTP Verbs are set to false.
Change them to true.
It should now read as below
<verbs allowUnlisted="false" applyToWebDAV="true">
<add verb="GET" allowed="true" />
<add verb="HEAD" allowed="true" />
<add verb="POST" allowed="true" />
<add verb="DELETE" allowed="true" />
<add verb="TRACE" allowed="false" />
<add verb="PUT" allowed="true" />
<add verb="OPTIONS" allowed="false" />
</verbs>
Save the file. You have enabled HttpPut and HttpDelete requests on your web server
The main solution is to remove webdavmodule from the specific website'd module's section.
So you can do it from both IIS and in webconfig.
I was dealing with the same problem. The solution for me was to turn off the Firewall mode of the Web Application in Plesk Panel.

Resources