Microsoft KB Archive/834452

= Best practices with custom error pages =

Article ID: 834452

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Internet Information Services 5.0
 * Microsoft Internet Information Services 5.1
 * Microsoft Internet Information Services 6.0

-





SUMMARY
Custom error pages are designed to display detailed error information that helps administrators and developers to troubleshoot and to solve Active Server Pages (ASP) coding issues. However, this detailed error information can provide the name of the ASP script that caused the error, a relative path to the script's location, and information about the line in the script that caused the error. This information could be used maliciously.

The following is an example of such an error: Technical Information (for support personnel)

Error Type: Microsoft VBScript runtime (0x800A01A8) Object required: '' /error.asp, line 20

Browser Type: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)

Page: GET /error.asp

Time: Wednesday, January 07, 2004, 8:28:37 PM



MORE INFORMATION
The Custom Error Pages feature relies on 500-100.asp. The default 500-100.asp file showcases some of the error reporting abilities that are available with custom error pages. Administrators and developers use this information to troubleshoot custom ASP applications. However, some of the information that is made available in 500-100.asp could be used maliciously.

On production Web sites that use the Custom Error Pages feature, Microsoft recommends that developers create their own custom error pages to provide customer-friendly information, such as support numbers and e-mail addresses, to permit customers to inform the system administrators of problems that they experience on the Web site.

The following is an example of a secure custom error page: <%@ language=&quot;VBScript&quot; %>

<%

Option Explicit

If Response.Buffer Then

Response.Clear

Response.Status = &quot;500 Internal Server Error&quot;

Response.ContentType = &quot;text/html&quot;

Response.Expires = 0

End If

%>

<!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01//EN&quot; &quot;http://www.w3.org/TR/html4/strict.dtd&quot;>

The page cannot be displayed





BODY { font: 8pt/12pt verdana }

H1 { font: 13pt/15pt verdana }

H2 { font: 8pt/12pt verdana }

A:link { color: red }

A:visited { color: maroon }



 

