IIS 7 "Send errors to browser" set to FALSE, but detailed errors still being shown in browser (Classic ASP) - BUG

0
votes

I found a bug in IIS7 and am looking for a workaround. After turning off client side and server side debugging for clients that still have their Classic ASP sites on my server, I discovered to my horror, that IIS 7 is STILL sending fully detailed messages to the client! I've specified custom error pages as well (all of which redirect to a generic error page except 404 errors - those just get displayed in full, including the internal path of the websites in question). I'm at wit's end and can't seem to find a work around or patch or anything.

I did a hack that generates "The page cannot be displayed because an internal server error has occurred." instead of displaying the 404 error by putting the following into the web.config file of the Classic ASP site in question:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <defaultDocument>
            <files>
                <remove value="index.html" />
                <remove value="index.php" />
                <remove value="default.aspx" />
                <remove value="iisstart.htm" />
                <remove value="index.htm" />
                <remove value="Default.htm" />
                <add value="index.asp" />
            </files>
        </defaultDocument>
        <httpErrors errorMode="DetailedLocalOnly" defaultResponseMode="File" >
            <remove statusCode="404" />
            <error statusCode="404" path="~\error404.htm" />
        </httpErrors>
    </system.webServer>
</configuration>

Unfortunately, the httpErrors tag doesn't seem to work properly for classic ASP sites, no matter what you put in the path variable, an internal server error will occur. The point is to remove the status code here as there is no way to do this globally in IIS 7 (at least that I can find). The good news is that there is no detailed 404 error, the bad news is that trapping 404 errors is not possible (for ASP).

Any better (working) ideas?

1
iis-7asp-classichttp-error
Detailed Errors will not be a 404 Not Found check what the 500.100 Internal Server Error is mapped to. – user692942
I've checked the IIS log and the application log and there are no errors reported. The IIS log only shows the page that was requested, but nothing else. – MC9000
You said that "that IIS 7 is STILL sending fully detailed messages to the client!" so check 500.100 in IIS 7 at the Error Pages section for the website, where is 500.100 mapped to? – user692942
The 500.100 error must be from putting the httpErrors tag in the web.config file. I have no idea why there is a 500 error - but it's clearly due to the setting in the web.config (no errors in the IIS log or application log - total mystery as to what it could be, but it's the only way to keep the 404's from showing in the browser for now) – MC9000
I found an error of sorts when attempting to access the site's Error Pages: This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false". this is a start – MC9000

1 Answers

0
votes

On IIS, go to your Website, go to ASP and change the Debugging Properties like following:

enter image description here

Change all to "False" and done.