UI Tips
LANGUAGES: All .NET Languages
ASP.NET VERSIONS: 1.0 | 1.1
Customize ASP.NET Error Messages
Keep error messages and stack information away from innocent users, as well as from prying eyes.
By Brad McCabe
One of the most appalling things that can be exposed to end user of an ASP.NET application or Web site is a screen full of error messages and confusing stack information. Besides confusing and frustrating the average end user, the information contained in the standard ASP.NET error screen provides plenty of information for the average hacker to cause mischief on your site. ASP.NET provides numerous simple strategies for addressing this issue.
You easily can configure custom error messages in the web.config file for a site or application. You can set these custom messages for all errors or specific status codes, and you can set them to display remotely only or for all connections.
Take a look at the customErrors tag in the web.config file:
<customErrors mode="remoteonly" defaultRedirect="error.htm">.
By setting the mode to "remoteonly", you have ASP.NET redirect any errors to your custom page, error.htm, but only for remote connections. This means a developer or administrator who accesses the site locally via LocalHost will see the standard ASP.NET error message, with all its debugging information, and remote users will be shielded from this.
Inside the <customErrors> tag, you can add custom redirects for the specific status codes. For example, a developer might want to render a custom page for the standard "HTML 404, File Not Found" message. To do this, add this tag inside the <customErrors> tag:
<error statusCode="404" redirect="adminmessage.htm"/>
The completed section of the web.config file would look like this:
<customErrors mode="remoteonly" defaultRedirect="error.htm">
<error statusCode="404" redirect="adminmessage.htm"/>
</customErrors>
By adding a few simple lines, you can have your users be redirected to a simple and elegant page explaining any errors or issues instead of the standard and confusing ASP.NET error page. The use of basic attributes to the customErrors section allows for customization of these personalized error pages.
Got a UI question, tip, or idea for a topic you'd like me to cover? I'd love to hear it. E-mail me at [email protected].
Brad McCabe is the technical evangelist for Infragistics. Brad also has been a systems architect and consultant for Verizon Communications and many other clients, and he was a leading .NET evangelist within Ajilon Consulting. His primary interests include ASP.NET, Windows CE .NET, .NET Compact Framework, and Microsoft's networking technologies. E-mail him at [email protected].
