DotNetOpenAuth provider don't work in ie11 on https - https

The site of our Openid provider revealed a problem with ie 11.
After login, when the provider is required to make the return redirect page is reloaded and again we find ourselves on the page, login and password.
After several attempts to get this error.
The lines on which the error occurs:
if (ProviderEndpoint.PendingAuthenticationRequest.IsDirectedIdentity) {
ProviderEndpoint.PendingAuthenticationRequest.LocalIdentifier = Code.Util.BuildIdentityUrl();
}
What is interesting, this problem occurs only when using https. When http everything is OK.

This issue is a result of the IE11 new User Agent String.
MS is already have a patch for .Net Framework 4, but it didn't work for me because I have .Net Framework 4.5 on the server while provider is using .Net Framework 4.0.
So I can't install the patch properly (link).
I temporarily solved this issue by using the value of UseCookies for the cookieless attribute in web.config file (<authentication><forms> section)

I can confirm this is also the solution for a custom MembershipProvider we use, which is derived from System.Web.Security.MembershipProvider.

Related

ASP.NET Core 3.1 Web API HTTP error 500 in production

I have an ASP.NET Core 3.1 Web API and it has worked so far. I had to modify the CORS setting in Start.cs and after that it gives HTTP 500 error in production IIS.
It works correctly when I run it in the Visual Studio even though if I run it on the server with double clicks.
Unfortunattelly IIS log doesn't contain any information about error.
I have no idea why this error occurs.
I over copied web.config and I forgot to overwrite modules="AspNetCoreModuleV2" to modules="AspNetCoreModule".
Sorry.

IIS : Exception from HRESULT: 0xC00CEF03

I have my website hosted on IIS with window 2016 OS. When I am going to disable the Form Authentication under IIS, it is giving me the following error.
Form Authentication.
Exception from HRESULT: 0xC00CEF03
i had a similar issue but it occurred when i was trying to disable the 'Machine key' - 'automatically generate at runtime' and then Applying the same.
For your error, please verify if the authentication is enabled/disabled for Default Web-site. Change that setting and then try disabling you specific websites status. It should ideally work.
I've seen this error stem from three different controls on the authentication method:
If configuring the authentication method on an application, and the authentication method you're trying to disable is enabled on the containing site.
If configuring the authentication method on a site, and the authentication method you're trying to disable is enabled on the Default Web Site.
If configuring the authentication method that has been defined in a web.config file. You should adjust it in the config file.
0xC00CEF03 error code translates to WR_E_NSPREFIXWITHEMPTYNSURI which refers to “Writer: cannot use prefix with empty namespace URI” (Reference).
This error occurs when there is something wrong with the web.config file. It’s probably corrupted or there are incompatible tags and parameters. As a result of this corruption and incompatibility, IIS is not able to read this file. Therefore, it can’t make a change.
The issue mostly happens after migration because a piece of configuration that works in the older version of IIS (and .NET Framework) probably became unsupported in the newer version.
The shortest way of finding what part of the web.config is causing the issue is to remove sections one by one and test. High-level steps:
Remove a section from the bottom of the file (Let’s say you removed system.serviceModel section)
If the issue goes away, add the section back and start removing the subsections of it one by one. (For example, ws2007HttpBinding subsection in system.serviceModel section)
If the issue goes away again, bring the subsection back and go through each lines. Prefixes like wsid:, asm:, and trust: are the most common causes of this issue
Source: 0xC00CEF03 error (Cannot use prefix with empty namespace URI)

Breeze metadata returns 504 error

I've run into an issue with Breeze such that when I try to call the Metadata action on my controllers, they fail with a 504 error.
The approximate call is
//servername/breeze/controller/metadata
Environment
Web Api running via IIS7 on load balanced Win 2k8 Azure Virtual Machines
Versions (installed via NuGet)
Breeze Client 1.4.2
Breeze Client and Server 1.4.2
Breeze Server - for ASP.NET Web Api (Core) 1.4.2
Breeze Server - for ASP.NET Web Api and Entity Framework 1.4.2
Update: Upgrading to Breeze 1.4.5 makes no difference
Previously it worked fine and the only recent change is the introduction of load balancing.
Of note, I also have multiple controllers, each with their own metadata.
Cases where it runs sucessfully
Running via localhost.
Removing the [BreezeController] attribute from my controller
Renaming the metadata function
Cases where it fails
When deployed
When running a simple test to return a string, eg:
[HttpGet]
public string Metadata()
{
return "This was a test";
}
For some reason Breeze does not seem to like the Metadata function in my controller.
Updates:
It doesn't look like its specifically related to using a load balanced endpoint as I tried setting it up running directly on port 8080 with a non load balanced endpoint and had the same issue.
IIS failed request tracing doesn't seem to log anything for the failed request, though the request does appear in the IIS logs.
I had the same problem after updating from 0.72 to 1.41 and changing the route from api/{controller}/{action} to breeze/{controller}/{action}. I did not get an answer from the breeze folks so I withdrew the question.
However, I now think the problem was permissions. Localhost:50033 in VS ran as me and I have a SQL Server account, so I though it would be cool. After deployment to my local IIS and to a test server IIS, I was getting a 500 error.
I finally got way into the jquery code and determined from the jqXHR, that the error was SQL not handling the credentials for the anonymous user; a Doh! moment if there ever was one. I changed my connection string in web.config and that did it.
<!--<add name="PilotPlant" connectionString="Data Source=dataweb;Database=PilotPlant;Integrated Security=SSPI;" providerName="System.Data.SqlClient" />-->
<add name="PilotPlant" connectionString="Data Source=dataweb;Database=PilotPlant;Trusted_Connection=no;User Id=sa;Password=sapassword" providerName="System.Data.SqlClient"/>
This is less secure, but I am running inside the firewall, so it is not a problem for me.
So my answer is check your permissions on the cluster. I hope this helps.

500 error when integrating multiple apps in one code base

I'm trying to set up an MVC application that will service several facebook applications for various clients. With help from Prabir's blog post I was able to set this up with v5.2.1 and it is working well, with one exception.
At first, I had only set up two "clients", one called DemoStore and the first client, ClientA. The application determines what client content and facebook settings to use based on the url. example canvasUrl: http://my_domain.com/client_name/
This works for ClientA, but for some reason when I try any DemoStore routes I get a 500 error. The error page points to an issue with the web.config.
Config Error:
Cannot add duplicate collection entry of type 'add' with unique key attribute 'name' set to 'facebookredirect.axd'
I am able to add additional clients with no problem, and changing DemoStore to something like "demo" while using the same facebook application settings works fine also.
Working calls:
http:// localhost:2888/ClientA/
http:// localhost:2888/ClientB/
http:// localhost:2888/Demo/
Failing call:
http:// localhost:2888/DemoStore/
I was thinking this might be an MVC issue, but the Config Error points to the facebookredirect handler. Why would the SDK try to add this value to the config during runtime, and only for this specific client?
Any insight would be greatly appreciated.
I managed to figure out what went wrong here. Silly mistake..
After I had set up the application routes to require the client_name I changed the Project Url in the project properties to point to demostore by default. When I hit ctrl+S a dialog popped up that I promptly entered through without reading.
When I changed the Project Url, IIS Express created a new virtual directory for the project. This was the source of my problem. Why? I'm not sure, but once I removed the second site from my applicationhost.config I was able to access the DemoStore routes.
Moral of the story: read the VS dialog messages!

Getting a 404 when using .NET 4 on IIS 6, with or without MVC

I've completed this set up on a fair few IIS 6 boxes, but one is giving me a tough time.
The problem occurs when I add the application extension mapping to:
c:\windows\microsoft.net\framework\v4.0.21006\aspnet_isapi.dll
When this is in place, I get a 404 error on every request.
Even if I remove all files from the application directory apart from a basic test.htm and navigate to that, I still get a 404.
I've unchecked the "Verify that file exists"
I've set up a .NET 4 application pool and pointed my application to that
I've changed the ASP.NET version to 4.0.21006
I've checked the IIS log file, and there's nothing useful in there (it only shows the first bunch of requests after each reboot and then stops logging)
I've checked the application event log and nothing gets reported
I've installed MVC 2
I've copied the set up onto another box, just to be sure, following all the same steps - and it all works!
What else can I look out for??
N.B:
If I set .NET to v2 in IIS, then I can successfully navigate to \test.htm
Go into Web Service Extensions in IIS and set ASP.NET 4.0 to Allowed instead of Prohibited.
Like this:
BTW: This happened to me in the RTM version of .net 4 as well, so it's not just the betas.

Resources