IIS Express10, removing https from configuration prevent site from running - iis

ASP NET MVC5 web application, Visual Studio 2015, IIS 10
Along the development I had to implement SSL. I just cannot say why, maybe Conveyor by Keyoti, maybe Elmah, maybe a local smtp server.. something required it. It's not really that important.
Having to test the application upon deployment on a remote server I have now to remove the https stuff. So I click on my project, then F4 to open the property window. Set SSL Enabled = False, check applicationhost.config.
<site name="xyz" id="2">
<application path="/" applicationPool="Clr4IntegratedAppPool">
<virtualDirectory path="/" physicalPath="C:\Users\NucLuke\Documents\Visual Studio 2015\test\xyz\xyz/>
</application>
<bindings>
<binding protocol="http" bindingInformation="*:51003:localhost" />
</bindings>
</site>
Everything looks just fine. So I close VS, start it again, run website getting no errors but
Unable to connect
IIS Express running application panel shows everything is fine:
How can I trace what's going on?
If the problem was on website I should be able to track it at debugging, but that doesn't seem the case. Is there a way to trace IIS Express?

Something was forcing the application to switch to SSL and I could not remember WHAT. My bad, but I suppose that is not so uncommon when you work for quite a long time on development implementing several extension.
In my particular case implementing Google login required SSL to be turned ON and a
[RequireHttps]
attribute in HomeController. This attribute was accountable for forcing IIS to modify config files in order to serve the home page as https. Hope this can help someone else not to lose one day looking for such a silly error.

Related

Turning on Anonymous Authentication, but IIS is still sending 401 with kerberos/windows auth request

Ok, so on my new site bob.testing.com, I set it up as anonymous authentication. Under it, i have a folder called apps. That's not an app, and there's no configuration on it. Under apps, I have a folder called MyApp. Originally, I set this up as Windows Authentication, but later I needed to update it to Anonymous. If I rename this folder to MyApp2 and create the application it works with Anonymous Authentication. When I rename it back... it sends back 401. I've tested with Fiddler, tried changing browsers, had someone else at work try it. Same results. I've tried recycling app pool, changing app pool, restarting IIS...
Anyone know how to delete whatever information IIS has cached about this application? I'd prefer not to have to rename and refactor my other apps for this item.
So, after posting; I actually looked here:
C:\Windows\System32\inetsrv\config\applicationHost.config
It was listed with two location path's. I ended up just deleting both and then setting it up again as an application. It appears to be working for now...
Looked something like this:
<location path="bob.testing.com/apps/MyApp">
<system.webServer>
<security>
<authentication>
<anonymousAuthentication enabled="false" />
<windowsAuthentication enabled="true" />
</authentication>
</security>
</system.webServer>
</location>

Azure websites throw 500 error when there is a colon in the URL

External clients are hitting my Azure website with urls that contain the colon (:) character. The request are not valid, but on my old IIS server it would give a 404 error. On Azure, the same URL will give a 500 error. This wastes my time, as I have to check the logs. This is an example of a request:
http://www.example.com/http:/www.example.com
Is there any way of avoiding this behaviour on the server side, and give 4xx error instead? Keep in mind, this problem is on Azure only, and I do not control the requests.
If you are running a .NET application, then this is caused by ASP.NET HTTP runtime, more specifically by its request filtering feature.
If the URL path contains any of the disallowed characters (<,>,*,%,&,:,\\,?), the runtime throws the exception and because of the exception the IIS returns error code 500.
System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (:).
You can configure disallowed characters in your web.config file.
<system.web>
<httpRuntime targetFramework="4.5" requestPathInvalidCharacters="*,%" />
</system.web>
But i would be careful, because there might be some security implications of such change.
Using the KUDU Console in Azure add the file applicationhost.xdt to D:\home\site.
<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document- Transform">
<system.applicationHost>
<sites>
<site name="%XDT_SITENAME%" xdt:Locator="Match(name)">
<virtualDirectoryDefaults xdt:Transform="Insert" allowSubDirConfig="false" />
</site>
</sites>
This does the job, but has an unfortunate side effect, in that any web.config in any application subdirectory was ignored. For our side, this had the effect of not loading any static files which meant the site did not work properly.
This will work fine for any site having a single web.config at root level.

NetScaler/IIS: 413 Entity Too Large

I am facing an issue where I am getting a 413 Request Entity Too Large whenever I post/put JSON to our servers running IIS 7.5 through a Citrix NetScaler.
We have tried to set the aspnet:MaxJsonDeserializerMembers to 30000, 40000 and 512000, as so:
<appSettings>
<add key="aspnet:MaxJsonDeserializerMembers" value="xxx" />
</appSettings>
as well as setting the <jsonSerialization maxJsonLength="xxx"/>
But without any resolution.
Setting the aspnet:MaxJsonDeserializerMembers in our local test environment, where we don't have a Citrix NetScaler, works just fine .
Is there any settings in the NetScaler that I should know of? or Is there some IIS settings I have to be aware of as well, considering that this works in our local test environments I am leaning towards the later, but I wan't all basis covert.
Edit: After further investigation, it surely seems that the NetScaler is the source as we can post to the API from behind the NetScaler.
As it turns out, it was actually a combination between the two products.
Internally we use SSL and Client Certificates which means we needed to configure a IIS property called "uploadReadAheadSize"
http://forums.asp.net/t/1702122.aspx?cannot+find+uploadReadAheadSize+in+applicationHost+config+in+IIS7+5
This is done in the host config or though the IIS manager.
...
<system.webServer>
<serverRuntime uploadReadAheadSize="{BYTES}" />
</system.webServer>
...
We used 10 MB = 10485760 Bytes for now which shows to be enough. Since this is defaulted to 48KB you may reach this rather fast.

Bad Request- Invalid Hostname while connect to localhost via wifi from mobile phone

I get the Bad Request- Invalid Hostname [HTTP ERROR 400] while trying connect my laptop's localhost.
Actually, I am learning to develop mobile web using jQuery Mobile.
I want to see the layout of the web whether fit my phone size.
i have added the port number which given by the Visual Studio with this way:
Control Panel> Firewall> Advanced Settings> Inbounce Rules> New Rule.
Then, i get my IP address by typing "ipconfig" at Command Prompt.
After that, I use my Android phone browser (Mozilla 5.0) and enter the link 192.XXX.XXX.XXX:57976.
I have read similar questions but I can't get the solution.
Some people think this error is related to the IIS settings.
But I can't get the solution of the IIS settings.
Hope you guys can help me solve this problem.
Step 1: Add Inbound Rule of Windows Firewall
Open the Windows Firewall with Advanced Security.
At the left panel, right click on Inbound Rule > New Rule
Rule Type: Port
Protocol and Ports: TCP
Specific local ports: 57976
Action: Allow the connection
Profile: Tick all (Domain, Private, Public)
Name: Name, Description(optional)
Finish.
Step 2: IIS or IIS Express
Add Bindings of IIS Manager
Open the IIS Manager.
At the left panel, Go to Sites > Default Web Sites.
At the right panel, click on the Bindings. Then, the new dialog pop ups.
At the pop-up dialog, click on the "Add" buttons. Input the port number and the hostname.
For my case,
port = 57976;
hostname = 192.XXX.XXX.XXX (my IP address)
Add Bindings of IIS Express (Visual Studio)
Stop the current Site
For Visual Studio 2015, change the IIS config under your project folder C:\Projects\<ProjectName>\.vs\config\applicationhost.config‌​.
For previous version of Visual Studio 2015, change the IIS config under IIS Express folder C:\Users\<your profile name>\Documents\IISExpress\config\applicationhost.config
In applicationhost.config, search by the port number (for my case is 57976), then one more binding with your IP Address
<site name="Web(1)" id="9">
<application path="/" applicationPool="Clr4IntegratedAppPool">
<virtualDirectory path="/" physicalPath="E:\abc\project\dev\web" />
</application>
<bindings>
<binding protocol="http" bindingInformation="*:57976:localhost" />
<binding protocol="http" bindingInformation="*:57976:192.XXX.X.XXX" />
</bindings>
</site>
Updated:
For windows 10 or Visual Studio 2015 users,
you may get the error message below:
Unable to launch the IIS Express Web server, Failed to register URL, Access is denied
Solution:
Close Visual Studio
Right click on Visual Studio > Run as
Administrator
Reference: https://azure.microsoft.com/en-us/documentation/articles/mobile-services-dotnet-backend-how-to-configure-iis-express/
Clear Browser data ctrl+shift+del

Write requests to log file in IIS

I have a cabinet which consists of several servers, handling quite a bit of traffic.
I need to construct a system to keep statistics - and I struggle to find out if it's possible or makes sense to make a null-request to a server? That is, calling something like http://XXX.XXX.XXX.XXX?objectid=9563828&sreq=2854&nc=29291947829 and letting IIS do nothing with it, except adding the request in the log.
As mentioned, my servers handle a lot of traffic - and every bit of CPU-power and byte I can save, counts in the long run = save money.
At the moment, my plan is to make IIS return nothing on 404-errors, but I'm not sure if this is the best approach. And are all requests logged (having caching in mind)?
Theories or suggestions, please?
Solved - it is possible by adding
<configuration>
<system.webServer>
<httpErrors existingResponse="PassThrough" />
</system.webServer>
</configuration>
in the configuration file. The reason I didn't succeed, is that this command is apparently only supported from IIS 7.0 and later and I was testing it on a version 6.5

Resources