ASP.NET MVC4 CustomErrors DefaultRedirect Ignored

Question

I have an MVC 4 app, using a custom HandleErrorAttribute to handle only custom exceptions. I would like to intercept the default 404 and other non-500 error pages and replace t

Answer 1

I want to share my knowledge after investigating this problem. Any comments that help improve my statements are welcomed.

In ASP.NET MVC, there are three layers that handle HTTP requests in the following order (response is transferred in reverse order):

1. IIS (HTTP Layer)

2. ASP.NET (Server Layer)

3. Controller (MVC Layer)

All of these layers have error handling, but each layer does it differently. I'll start with IIS.

IIS Layer

The simplest example of how IIS handles an error is to request a non existing .html file from your server, using the browser. The address should look like:

http://localhost:50123/this_does_not_exist.html

Notice the title of the browser tab, for example: IIS 10.0 Detailed Error - 404.0 - Not Found.

ASP.NET Layer

When IIS receives a HTTP request, if the URL ends with .aspx, it forwards it to ASP.NET since it is registered to handle this extension. The simplest example of how ASP.NET handles an error is to request a non existing .aspx file from your server, using the browser. The address should look like:

http://localhost:50123/this_does_not_exist.aspx

Notice the Version Information displayed at the bottom of the page, indicating the version of ASP.NET.

The customErrors tag was originally created for ASP.NET. It has effect only when the response is created by ASP.NET internal code. This means that it does not affect responses created from application code. In addition, if the response returned by ASP.NET has no content and has an error status code (4xx or 5xx), then IIS will replace the response according to the status code. I'll provide some examples.

If the Page_Load method contains Response.StatusCode = 404, then the content is displayed normally. If additional code Response.SuppressContent = true is added, then IIS intervenes and handles 404 error in the same way as when requesting "this_does_not_exist.html". An ASP.NET response with no content and status code 2xx is not affected.

When ASP.NET is unable to complete the request using application code, it will handle it using internal code. See the following examples.

If an URL cannot be resolved, ASP.NET generates a response by itself. By default, it creates a 404 response with HTML body containing details about the problem. The customErrors can be used to create a 302 (Redirect) response instead. However, accessing a valid URL that causes ASP.NET to return a 404 response does not trigger the redirect specified by customErrors.

The same happens when ASP.NET catches an exception from application code. By default, it creates a 500 response with HTML body containing details about the source code that caused the exception. Again, the customErrors can be used to generate a 302 (Redirect) response instead. However, creating a 500 response from application code does not trigger the redirect specified by customErrors.

The defaultRedirect and error tags are pretty straight-forth to understand considering what I just said. The error tag is used to specify a redirect for a specific status code. If there is no corresponding error tag, then the defaultRedirect will be used. The redirect URL can point to anything that the server can handle, including controller action.

MVC Layer

With ASP.NET MVC things get more complicated. Firstly, there may be two "Web.config" files, one in the root and one in the Views folder. I want to note that the default "Web.config" from Views does two things of interest to this thread:

• It disables handling URLs to .cshtml files (webpages:Enabled set to false)
• It prevents direct access to any content inside the Views folder (BlockViewHandler)

In the case of ASP.NET MVC, the HandleErrorAttribute may be added to GlobalFilters, which also takes into account the value of mode attribute of the customErrors tag from the root "Web.config". More specifically, when the setting is On, it enables error handling at MVC Layer for uncaught exceptions in controller/action code. Rather than forwarding them to ASP.NET, it renders Views/Shared/Error.cshtml by default. This can be changed by setting the View property of HandleErrorAttribute.

Error handling at MVC Layer starts after the controller/action is resolved, based on the Request URL. For example, a request that doesn't fulfill the action's parameters is handled at MVC Layer. However, if a POST request has no matching controller/action that can handle POST, then the error is handled at ASP.NET Layer.

I have used ASP.NET MVC 5 for testing. There seems to be no difference between IIS and IIS Express regarding error handling.

Answer

The only reason I could think of why customErrors is not considered for non-500 status codes is because they are created with HttpStatusCodeResponse. In this case, the response is created by the application code and is not handled by ASP.NET, but rather IIS. At this point configuring an alternative page is pointless. Here is an example code that reproduces this behavior:

public ActionResult Unhandled404Error()
{
    return new HttpStatusCodeResult(HttpStatusCode.NotFound);
}

In such scenario, I recommend implementing an ActionFilterAttribute that will override OnResultExecuted and do something like the following:

int statusCode = filterContext.HttpContext.Response.StatusCode;
if(statusCode >= 400)
{
    filterContext.HttpContext.Response.Clear();
    filterContext.HttpContext.Response.Redirect("/Home/Index");
}

The implemented ActionFilterAttribute should be added to GlobalFilters.