We have been reviewing security on our Web application hosted on a Winhost Server. The advice we seem to be seeing is to add <system.web> <deployment retail="true"/> </system.web> to our web.config file. When we do this, we get the following: Server Error in '/' Application. Configuration Error Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately. Parser Error Message: It is an error to use a section registered as allowDefinition='MachineOnly' beyond machine.config. Source Error: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine. Source File: E:\xxx\xxx\web.config Line: 16 I would love some suggestions on what we're doing wrong.
<deployment retail=”true”/> disables certain functions on a server-wide level, so it cannot be set in web.config (as your error points out, it has to be set in machine.config, which you do not have access to on a shared server). What are you trying to achieve?
We are trying to make our App secure and in our understanding, allowing a Stack Trace is a bad move. Ideally, we would like to present a custom error page, that allowed the user to resubmit the page that failed without losing the information it was trying to post. This is what we're getting at the moment: Server Error in '/' Application. Fake Nudge Error! Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. Exception Details: System.Exception: Fake Nudge Error! Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below. Stack Trace: [Exception: Fake Nudge Error!] Db4oWebApplication.Fault.Page_Load(Object sender, EventArgs e) +175 System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +51 System.Web.UI.Control.OnLoad(EventArgs e) +92 System.Web.UI.Control.LoadRecursive() +54 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +772 Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.36392 What we would like to see: Our custom content, ie an icon, a custom fail message, but most importantly the ability to resubmit (F5) the page. We are using the browser editor to make extensive text changes to our product content. It is important that in the event of an error, due to Service availability or a programming issue, then the browsing user can resubmit their form without losing what could be an hours worth of work. The stack trace option does allow the user to resubmit, custom errors do not.
