• Choose a category
• All
• Classic-Fiction

By Root 5395 0

The content of the default error page is not relevant; what matters is that you don’t provide means to potential attackers to distinguish between types of responses.

The Section

The section indicates the deployment mode of the application and has only one Boolean attribute, named retail. The attribute indicates whether the application is intended to be deployed for production (retail equals true) or test (retail equals false).

When retail is set to true, ASP.NET automatically disables certain configuration settings, such as trace output, custom errors, and debug capabilities. When the default value of retail is false, each application is automatically deployed for testing.

The Section

The section configures the globalization settings of ASP.NET applications so that requests and responses take into account encoding and culture information. The attributes of the section are shown in Table 3-8.

Table 3-8. Globalization Attributes

Attribute

Description

culture

Specifies the culture to be used to process requests.

fileEncoding

Specifies the encoding for ASP.NET resource files (.aspx, .asmx, and .asax). Unicode and UTF-8 files saved with the byte order mark prefix are recognized regardless of the value of the attribute.

requestEncoding

Specifies the assumed encoding of each request, including posted data and the query string. The default is UTF-8.

responseEncoding

Specifies the content encoding of responses. The default is UTF-8.

uiCulture

Specifies the culture name to be used to look up locale-dependent resources at run time.

Note that, if specified, the Accept-Charset attribute in the request overrides the default requestEncoding setting. If you remove any encoding setting from the configuration files, ASP.NET defaults to the server’s locale. In the majority of cases, requestEncoding and responseEncoding have the same value.

Valid names for the culture and uiCulture attributes are non-neutral culture names such as en-US, en-AU, and it-IT. A culture name is made of two elements—the language and country/region—and both are to be specified in this context.

The Section

The section allows you to register application-specific HTTP handlers that take care of ad hoc URLs invoked over given HTTP verbs. I’ll dissect the syntax and usage of the section in the next chapter.

The Section

The section allows you to register application-specific HTTP modules that take care of hooking up specific stages during the processing of an ASP.NET request. I’ll dissect the syntax and usage of the section in the next chapter.

The Section

Health monitoring is a system feature that allows the production staff to monitor the status of a deployed application and track significant events related to performance, failures, and anomalies. The ASP.NET health monitoring system works by firing events to providers. The event contains actual information about what happened; the provider processes the information. Here is the overall schema:

enabled="true|false"

heartbeatInterval="HH:MM:SS">

...

...

...

...

...

The enabled attribute specifies whether health monitoring is enabled. It is true by default. The heartbeatInterval attribute indicates how often the heartbeat event is raised. The heartbeat event serves as a timer for the whole subsystem and is raised at regular intervals to capture useful runtime state information. The heartbeat is just one of the events that the health monitoring system can detect. Other events track unhandled exceptions, request processing, application lifetime, and the success and failure audits. Child sections, listed in Table 3-9, let you configure the whole subsystem.

Table 3-9. Elements for Health Monitoring