ASP.NET C# Error Page

Question

Hi ,

we have deployed application on IIS .

Application lording login page .

I enter garbage values on URL.

such as - //Domain-name/a%22%3E%3Cscript%3Ealert(123);%3C/script%3EFolderName/Login.aspx

Local machine working but deploying application on IIS this time not working.

Application_Error method not calling

Kindly help me.

Regards,

Pratik

Deepika Sawant · Answer

IIS itself rejects certain malformed URLs (invalid characters, double slashes, encoded fragments) before ASP.NET gets a chance to process them. That’s why doesn’t trigger — the request is blocked at the IIS level. By default, IIS blocks requests containing , > , " , and other dangerous sequences to mitigate XSS and injection attacks. It’s generally good that IIS blocks these requests before they hit your app. Don’t disable filtering unless you have a strong reason (like needing to test XSS handling). Instead, configure custom error pages and rely on IIS logs for monitoring. Options to handle this 1. Configure IIS Request Filtering If you want ASP.NET to see these requests (for logging or custom error handling), you can relax IIS’s request filtering: allowDoubleEscaping="true" lets IIS pass encoded characters like %3C ( ) to ASP.NET. Be careful: this increases exposure to malicious requests. Only enable if you need to log/analyze them. 2. Use IIS Custom Errors Since IIS is blocking the request, configure IIS-level custom error pages : This way, even if ASP.NET never sees the request, IIS will show a friendly error page instead of a raw 400/404. 3. Centralized Logging If your goal is logging attacks/garbage URLs : Use IIS logs (enabled by default) — they capture rejected requests. Consider a WAF (Web Application Firewall) or middleware logging at the reverse proxy level. 4. Keep Application_Error for ASP.NET exceptions Remember: Application_Error only catches exceptions inside the ASP.NET pipeline . For IIS-level rejections, you must rely on IIS custom errors or logs. Leave IIS request filtering ON (default). Add custom error pages for 400/404. Use IIS logs for monitoring garbage/malicious requests.

ASP.NET C# Error Page

Insert Link

Embed YouTube Video

Table Options

Insert Image

Answers (1)