Prevent error page action executing directly from a request

Question

In asp.net-core we can show user-friendly error pages by adding the StatusCodePages middleware to the pipeine. In Startup.cs

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory) { // code ... app.UseExceptionHandler("/error/500"); app.UseStatusCodePagesWithReExecute("/error/{0}"); // code ... }

With above code, when an unhandled exception occurs or a requested resource can not be found, the responses is handled by redirecting to /error/{0}. Framework correctly invokes this action

[Route("[controller]")] public class ErrorController : Controller { [HttpGet("{statusCode}")] public IActionResult Error(int statusCode) { Response.StatusCode = statusCode; return View("Error", statusCode); } }

The problem starts when client directly requests something like ~/error/{int}. For example www.example.com/error/500 or www.example.com/error/400

In these cases again the above action is being invoked (from MVC not StatusCodePages middleware) and client gets a 500 and a 400 response. In my opinion, 404 status code must be returned for all ~/error/{int} requests.

Is there any solution, when client makes a ~/error/{int} request to prevent MVC middleware from invoking the error action?

Try adding a 'constraint' to the standard MVC route controller to bypass 'error' controller. Another possibility might be to make the error controller accessible only to an internal process - not a user. — SRQ Coder
– SRQ Coder, Commented Apr 11, 2016 at 20:12
Why do you care if the user does make a direct request to ~/error/500? — Tratcher
– Tratcher, Commented Apr 12, 2016 at 16:54
@SRQCoder if I use route constraint then I do not get the error page at all. I am not sure how to implement your second suggestion. — tmg
– tmg, Commented Apr 12, 2016 at 18:40

Shaun Luttin · Accepted Answer · 2016-04-12 01:41:29Z

Use HttpContext.Features.Get<IExceptionHandlerFeature>() to check whether an error has occurred. If one hasn't, then return a 404. Here is an example.

ErrorController.cs

using Microsoft.AspNet.Diagnostics; using Microsoft.AspNet.Http.Features; using Microsoft.AspNet.Mvc; [Route("[controller]")] public class ErrorController : Controller { [HttpGet("{statusCode}")] public IActionResult Error(int statusCode) { var feature = HttpContext.Features.Get<IExceptionHandlerFeature>(); if (feature == null || feature.Error == null) { var obj = new { message = "Hey. What are you doing here?"}; return new HttpNotFoundObjectResult(obj); } return View("Error", statusCode); } }

According to the docs (emphasis added),

The HttpContext type... provides an interface for getting and setting these features... Use the pattern shown above for feature detection from middleware or within your application. Calls made to GetFeature will return an instance if the feature is supported, or null otherwise.

Collectives™ on Stack Overflow

Prevent error page action executing directly from a request

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related