Search code examples
c#asp.netiisweb-config

Why ASP.NET website customErrors mode="Off" not working

Our ASP.NET 4.0 web application on production server (Windows Server 2008 R2 64bit with IIS7.5) is not showing detailed error message despite adding the following settings in the web.config file:

<?xml version="1.0"?>
<configuration>
    <system.web>
        <customErrors mode="Off"/>
    </system.web>
</configuration>

According to this MSDN article, we should get the detailed error message but we are getting the following custom error message that's displayed on an error page that we direct to in the "catch" block of try/catch when an error occurs:

Application has encounter an error, please try again later. If the problem persists please contact the system admin at: ....."

We also tried this suggestion but still on an error on the try/catch block the above message gets displayed. We even restarted the IIS to make sure the web.config changes get applied but not luck. We have made sure the above settings are not repeated in the web.config file and that there are no other web.config files in the app.

Edit Moreover, we do not have <deployment ...> element in the machine.config file that means according to this MSDN article, <deployment retail="false"> is the default.

Solution

  • Your problem is you are catching the error and then redirecting to the error page, so there is no unhandled error -- meaning no error is bubbling up to cause a "Yellow Screen Of Death" (which is what you will see when mode="Off").

    Granted, you don't want mode="Off" on production because it is revealing. mode="RemoteOnly" will only YSOD locally and is the preferred method.

    To test and see a YSOD, put throw new Exception(); directly after Page_Load (outside of a try/catch block) and then run the page locally.

    Since you are already catching the exception, you could have some sort of error handling that logs the error details (what you are looking for) to a database or file so you can check to see what is happening with your website. Though I don't really agree with this method because then:

    1. You apparently are catching unexpected exceptions which means you are unaware of potential problems with your site because they are being hidden, and

    2. you have to put error handling / redirects in every page. You don't need to do this.

    Instead, consider using Elmah which is on NuGet and provides an easy way to log errors (or you could implement your own custom logging from the global.ascx).

    Then, stop catching all exceptions. Just catch exceptions you expect to happen and don't care that they happen and don't want to log (like a FormatException on a conversion). Unexpected exceptions will now bubble up, get logged by Elmah, and then you can use CustomErrors to redirect/display an error page... and you don't need to do any of this on the actual page's code behind (which saves you from putting error handling on every code-behind of every page). Elmah logs and lets you view the YSOD anytime you want. If you go this route, which is much easier than rolling your own error handling in the global.ascx, just make sure you secure elmah.