如何防止IIS7处理HTTP状态码401？

Question

我正在使用我的ASP.NET MVC 2项目.我创建了异常过滤器,用于捕获当用户无权查看某些操作时发生的未授权访问异常.

[CustomError(typeof(UnauthorizedAccessException), "Error", "UnauthorizedAccess")]
public class MyController : BaseController
{
}

异常被抛出之后,我的过滤器将转移到配置的控制器/动作了下面的方法.

public ActionResult UnauthorizedAccess(ExceptionContext context)
{
    Response.StatusCode = CustomHttpStatusCode.UnauthorizedUser;

    return View(model);
}

最后,前ASP.NET应用结束该请求时,它将调用下面的方法,其位于Global.ascx用于改变自定义的HTTP状态代码到HTTP状态401(未授权访问).

public void Application_EndRequest(object sender, EventArgs e)
{
    if (Response.StatusCode == CustomHttpStatusCode.UnauthorizedUser)
    {
        Response.StatusCode = 401;
    }
}

一切都在我的机器上工作正常(IIS 7.5).但它在我的部署网站上不起作用.它仍然返回纯文本"您没有权限查看该目录或网页." 而不是我的自定义错误页面.

PS.以下配置是本案例的当前web.config.

  <?xml version="1.0" encoding="UTF-8"?>
  <configuration>
    <system.web>
      <customErrors mode="On"></customErrors>
    </system.web>
    <system.webServer>
      <httpErrors errorMode="Custom">
         <remove statusCode="502" subStatusCode="-1" />
         <remove statusCode="501" subStatusCode="-1" />
         <remove statusCode="500" subStatusCode="-1" />
         <remove statusCode="412" subStatusCode="-1" />
         <remove statusCode="406" subStatusCode="-1" />
         <remove statusCode="405" subStatusCode="-1" />
         <remove statusCode="404" subStatusCode="-1" />
         <remove statusCode="403" subStatusCode="-1" />
         <remove statusCode="401" subStatusCode="-1" />
      </httpErrors>
    </system.webServer>
  </configuration>

Answer 1

我刚刚找到了解决这个问题的简单方法.我只是将新设置添加到web.config文件中,如下面的代码.我的部署网站上的一切正常.

  <?xml version="1.0" encoding="utf-8"?>
  <configuration> 
    <system.webServer>
      <httpErrors errorMode="Custom" existingResponse="PassThrough">
          <remove statusCode="502" subStatusCode="-1" />
          <remove statusCode="501" subStatusCode="-1" />
          <remove statusCode="500" subStatusCode="-1" />
          <remove statusCode="412" subStatusCode="-1" />
          <remove statusCode="406" subStatusCode="-1" />
          <remove statusCode="405" subStatusCode="-1" />
          <remove statusCode="404" subStatusCode="-1" />
          <remove statusCode="403" subStatusCode="-1" />
          <remove statusCode="401" subStatusCode="-1" />
      </httpErrors>
    </system.webServer>
  </configuration>

所以我也可以在纯文本和JSON响应中创建自定义错误页面.

有关更多信息:HttpErrorsSection类

PS.但我在IIS管理器的错误页面功能中找不到existingResponse属性.

Answer 2

您可以通过两种方式传递IIS7默认错误消息

一种是将response.TrySkipIisCustomErrors设置为true

response.TrySkipIisCustomErrors = true;
response.Status = response.Status;

出于某种原因,如果您未设置response.Status,则不会尝试TrySkipIisCustomErrors.

另一种是在web.config中将existingResponse设置为"PassThrough"

<configuration>
  <system.webServer>
    <httpErrors existingResponse="PassThrough" />
  </system.webServer>
</configuration>

但是这将忽略所有设置的IIS自定义错误页面.