ASP .NET Web Developer s Guide - Mesbah Ahmed, Chris Garrett

190 Chapter 4 • Configuring ASP.NET

extension=".cs"

type="Microsoft.CSharp. CSharpCodeProvider,System" /> <compiler

language="js;jscript;javascript"

extension=".js"

type="Microsoft.JScript.JScriptCodeProvider, Microsoft.JScript" />

</compilers>

<assemblies>

<add assembly="ADODB" /> <add assembly="mscorlib" />

</assemblies>

<namespaces>

<add namespace="System.Web" /> <add namespace="System.Web.UI" />

<add namespace="System.Web.UI.WebControls" /> <add namespace="System.Web.UI.HtmlControls" />

</namespaces>

</compilation>

</system.web>

</configuration>

Controlling Connections Using the <connectionManagement> Tag

The <connectionManagement> tag enables you to control the number of simultaneous connections allowed per address on your system. By using this tag, you can control the optimization of your pages.As an example, if you want to speed up access to a smaller number of users, then increase the number of simultaneous connections.This tag supports the <add>, <remove>, and <clear> subtags.The <add> subtag specifies the address(es) to set connection limits on. It has two attributes, address and maxconnection. Proper usage of the <add> subtag is illustrated in the following code sample.The <remove> subtag only accepts the address attribute and is used to remove addresses previously specified with the <add> subtag.Wildcards are also supported with the <remove> tag.The <clear> subtag removes all addresses from the configuration whether explicitly defined or inherited.

www.syngress.com

<configuration>

<system.net>

<connectionManagement>

<add

address="*"

maxconnection="2"

/>

</connectionManagement>

</system.net>

</configuration>

Defining Custom Errors

Using the <customErrors> Tag

By using the <customErrors> tag, you have the ability to define custom error messages for your application.This is generally used to point users to a friendlier message than the default error messages.This tag supports only two attributes and one subtag.The two attributes supported are defaultRedirect and mode.The defaultRedirect attribute accepts a string value representing the default URL to redirect the browser to when an error occurs.The mode attribute has three options: On, Off, and RemoteOnly.These options allow you to enable or disable custom error support or enable custom error support only for remote clients.

The <error> subtag supported by the <customErrors> tag enables you to set pages to redirect specific errors to.The <customErrors> tag supports the use of multiple <error> subtags, enabling you to redirect many different errors to the appropriate URL.The usage of these tags are outlined in the following code example:

<configuration>

<system.web>

<customErrors

defaultRedirect="error/unspecifiederror.aspx"

mode="RemoteOnly">

<error

statusCode="500"

redirect="error/internalerror.aspx"

/>

www.syngress.com

192 Chapter 4 • Configuring ASP.NET

<error

statusCode="404"

redirect="error/notfound.aspx"

/>

</customErrors>

</system.web>

</configuration>

Mapping Requests Using the <httpHandlers> Tag

The <httpHandlers> tag is used to map incoming requests to the appropriate

IHttpHandler or IhttpHandlerFactory class.This is done based on the URL requested and the verb used to request it. Some example verbs used by this are GET, POST, and PUT.You would use this if you had a custom handler that you wanted to implement when files with a certain extension are requested. As an example, you could use this if you had a custom virus scanner needed to be run against all files sent with a PUT request that have the .ZIP extension.You could develop a custom handler to do this and assign the handler to the .ZIP extension in combination with the PUT verb.This can also be used to restrict certain files from being viewed, by pointing them to the System.Web.HttpForbiddenHandler handler.The <httpHandlers> tag supports three subtags to control this configuration option: <add>, <remove>, and <clear>.

The <add> subtag is used to add new entries to the list and supports three attributes.The first is the verb attribute, which specifies specific verbs to apply this IHttpHandler or IhttpHandlerFactory to.This attribute does accept wildcards.The second attribute is path, which specifies either a specific URL path or a wildcard string.The final attribute is type, which specifies the class/assembly combination. ASP.NET has a specific search order for finding the appropriate DLL. It first checks in the application’s “bin” directory, and then in the system assembly cache.

The <remove> subtag accepts only the path and type attributes and is used to remove a previously specified mapping from the list.The <clear> subtag removes all mappings from the list whether they are explicitly defined or inherited.

The following code sample illustrates the use of the <httpHandlers> tag by adding a mapping for all .tmp files to be forbidden:

<configuration>

<system.web>

<httpHandlers>

www.syngress.com

<add verb="*" path="*.tmp" type="System.Web

.HttpForbiddenHandler, System.Web, Version=1.0.2411.0,

Culture=neutral />

</httpHandlers>

</system.web>

</configuration>

Configuring HTTP Modules

Using the <httpModules> Tag

The <httpModules> tag enables you to configure the HTTP modules used within your application.This tag supports the <add>, <remove>, and <clear> subtags.The <add> subtag specifies the HTTP module class to add to your application. It has two attributes, type and name. Proper usage of the <add> subtag is illustrated in the following code sample.The <remove> subtag accepts the same attributes of type and name and is used to remove HTTP modules previously specified with the <add> subtag.Wildcards are also not supported with the <remove> tag.The <clear> subtag removes all addresses from the configuration whether explicitly defined or inherited.

<configuration>

<system.web>

<httpModules>

<add

name="OutputCache"

type="System.Web.Caching.OutputCacheModule"

/>

<add

name="Session"

type="System.Web.SessionState.SessionStateModule"

/>

<add

name="WindowsAuthentication"

type="System.Web.Security.WindowsAuthenticationModule"

/>

</httpModules>

www.syngress.com

194 Chapter 4 • Configuring ASP.NET

</system.web>

</configuration>

Setting Runtime Options

Using the <httpRuntime> Tag

The <httpRuntime> tag enables you to set various runtime options for ASP.NET’s HTTP processing.These options are represented by the three available attributes for the <httpRuntime> tag. By changing these attributes, you can control the way ASP.NET functions when performing operations requested by the user.

The first attribute is useFullyQualifiedRedirectUrl.This attribute supports a boolean value of true or false, and configures whether ASP.NET uses fully qualified client-side redirects or relative redirects.The default is false, which specifies relative redirects. Fully qualified redirects are only used for some mobile controls or very early-stage Web browsers.

The second available attribute is executionTimeout, which specifies the maximum amount of time that a request is allowed to process before being terminated by ASP.NET.This is used both to terminate hung applications as well as to prevent badly coded applications from using up all your system resources.This attribute accepts a numeric value specified in seconds.

The final attribute for the <httpRuntime> tag is maxRequestLength.This attribute specifies a maximum file size that ASP.NET will accept as an upload.This is primarily used to prevent users from performing a denial of service attack by uploading large files to your server. In addition, it can help manage your disk capacity by limiting the size of the files your server accepts.This attribute accepts a numeric value in megabytes.These attributes are illustrated in the following code:

<configuration>

<system.web>

<httpRuntime

executionTimeout="90"

maxRequestLength="4096"

useFullyQualifiedRedirectUrl="false"

/>

</system.web>

</configuration>

www.syngress.com

Setting Process Model Options

Using the <processModel> Tag

The <processModel> tag is used to set various options for the ASP.NET process model.These options are represented by the 15 attributes supported by the <processModel> tag and are described in Table 4.9.The <processModel> tag can only be used within the machine.config file.

Table 4.9 <processModel> Tag Attributes

www.syngress.com

196 Chapter 4 • Configuring ASP.NET

Table 4.9 Continued

Continued

www.syngress.com

run ASP.NET processes. This enables you to dedicate processors completely to just process ASP.NET threads. The value for this attribute is the decimal conversion of the binary representation of processors that you wish to specify. For example, in a four-processor system, let’s assume that you wish to dedicate processors 0 and 1 to ASP.NET. The binary mask for this would be 0011. Translated to decimal, the value is 3. Processors 2 and 3 exclusively would be masked as 1100, which is 12 in decimal. This attribute is only valid

on multi-processor systems that have the webGarden attribute set to false.

Continued

www.syngress.com

198 Chapter 4 • Configuring ASP.NET

Table 4.9 Continued

userName attribute. This attribute accepts either a valid password or a value of AutoGenerate for use with the

Machine user id.

Continued

www.syngress.com

www.syngress.com