This very same question was asked multiple times on SO as well as many other forums and answer was more or less the same, No you cannot use location/clear/remove for configsection. Microsoft even replied on their thread as follows. Posted by Microsoft on 7/23/2009 at 5:40 PM <clear /> and <remove /> were never implemented … Read more
Asp.Net 4.0+ comes with a very strict built-in request validation, part of it is the potential dangerous characters in the url which may be used in XSS attacks. Here are default invalid characters in the url : < > * % & : \ ? You can change this behavior in your config file: <system.web> … Read more
You can encrypt the web.config with aspnet_regiis. This is to stop people with access to your server from reading sensitive information. By the way, I would put your config settings inside a class, that can then be injected into your controllers – it will make unit testing easier.
As a matter of fact you can do this, but it is not as easy as you might think. You can create your own config transformation. I have just written a very detailed blog post at http://sedodream.com/2010/09/09/ExtendingXMLWebconfigConfigTransformation.aspx regarding this. But here are the hightlights: Create Class Library project Reference Web.Publishing.Tasks.dll (under %Program Files (x86)%MSBuild\Microsoft\VisualStudio\v10.0\Web folder) … Read more
The default for debug attribute in the compilation is false MSDN – compilation Element (ASP.NET Settings Schema) debug Optional Boolean attribute. Specifies whether to compile debug binaries rather than retail binaries. The default is False.
Try this condition: <system.webServer> <rewrite> <rules> <rule name=”Redirect HTTP to HTTPS” stopProcessing=”true”> <match url=”^(.*)$”/> <conditions> <add input=”{HTTPS}” pattern=”^OFF$”/> <add input=”{HTTP_HOST}” matchType=”Pattern” pattern=”^localhost$” negate=”true” /> </conditions> <action type=”Redirect” url=”https://{HTTP_HOST}/{R:1}” redirectType=”SeeOther”/> </rule> </rules> </rewrite> </system.webServer> Using a negate condition against the localhost pattern should do the trick.
This works for me but I too have found it to be a bit flakey at times. You will need to create another file called Web.Config.Release and fill it with the following: <configuration xmlns:xdt=”http://schemas.microsoft.com/XML-Document-Transform”> <connectionStrings> <add name=”local” connectionString=”Data Source=IPAddress,Port;Initial Catalog=SomeOtherDB;User ID=TopSecretUsername;Password=SecurePassword” xdt:Transform=”SetAttributes” xdt:Locator=”Match(name)”/> </connectionStrings> <system.web> <compilation xdt:Transform=”RemoveAttributes(debug)” /> </system.web> <appSettings> <add key=”default_db_connection” value=”local” xdt:Transform=”SetAttributes” xdt:Locator=”Match(key)” … Read more
Ok, i’ve got it. The Problem is, that my systems a 64 Bit systems and the aspnet_regiis i’ve called was the 32 Bit Version. After calling aspnet_regiis from the Framework64 Directory everything was fine. Thanks to Scott Hanselman http://www.hanselman.com/blog/ASPNET4BreakingChangesAndStuffToBeAwareOf.aspx
It is possible to use a DB connection string specified in web.config without creating a new class, though you would need to use log4net build that hasn’t been released yet. It can be downloaded from SVN repository http://svn.apache.org/viewvc/logging/log4net/trunk/ Your config will look as follows: <connectionStrings> <add name=”connStr” connectionString=”Data Source=localhost; …” /> </connectionStrings> <log4net> <appender name=”AdoNetAppender” … Read more