Analysis of the Web. config file in Asp.net

1. Understand the Web. config file

Web. config is an XML text file used to store ASP. NET Web application configuration information (for example, the most common settings ASP. NET Web application authentication method), which can appear in every directory of the application. After you create a Web application using VB. NET, a default Web application is automatically created in the root directory by default.
The Web. config file, including the default configuration settings, inherits the configuration settings of all subdirectories. If you want to modify the configuration settings of a subdirectory, you can create a Web. config file under the subdirectory. It can provide configuration information other than the configuration information inherited from the parent directory, or rewrite or modify the settings defined in the parent directory.

Modifications to the Web. config file at runtime can take effect without restarting the Service (note: the exception in <processModel> section ). Of course, the Web. config file can be expanded. You can customize new configuration parameters and write the configuration section handler to process them.

Ii. All the following code should be located in the web. config configuration file (default configuration settings)

<Configuration>
<System. web>

And

</System. web>
</Configuration>

For the purpose of learning, the following examples omit this XML tag.

1. <authentication> section

Purpose: Configure ASP. NET authentication support (Windows, Forms, PassPort, None ). This element can only be declared at the computer, site, or application level. The <authentication> element must be used with the <authorization> section.

Example:

In the following example, the website is configured for form-based authentication. When a user who does not log on to the website that requires authentication, the webpage automatically jumps to the logon webpage.

<Authentication mode = "Forms">
<Forms loginUrl = "logon. aspx" name = ". FormsAuthCookie"/>

</Authentication>

The element loginUrl indicates the name of the login webpage, and name indicates the Cookie name.

2. <authorization> section

Purpose: control access to URL resources from clients (for example, Anonymous Users are allowed ). This element can be declared at any level (computer, site, application, subdirectory or page. Must be used with the <authentication> section.

Example: The following example disables access by anonymous users:

<Authorization>
<Deny users = "? "/>
</Authorization>

Note: You can use user. identity. name to obtain the user name that has been verified. You can use
The web. Security. FormsAuthentication. RedirectFromLoginPage method redirects authenticated users to the page the user just requested. For specific examples, see:

Forms VerificationHttp://www.fanvb.net/websample/dataauth.aspx

3. <compilation> section

Purpose: configure all compilation settings used by ASP. NET. The default debug attribute is "True". After the program is compiled and delivered, set it to True (the Web. config file is described in detail, and the example is omitted here)

4. <customErrors>

Purpose: Provide information about custom Errors for ASP. NET applications. It is not applicable to errors in XML Web services.

Example: When an error occurs, redirect the webpage to the custom error page.

<CustomErrors defaultRedirect = "ErrorPage. aspx" mode = "RemoteOnly">
</CustomErrors>

The defaultRedirect element indicates the name of the custom error webpage. Mode element: displays custom (friendly) information for users not running on the Local Web server.

5.

Purpose: Configure ASP. net http Runtime Library settings. This section can be declared at the computer, site, application, and subdirectory level.

For example, the maximum size of a file to be uploaded is 4 MB, the maximum time is 60 seconds, and the maximum number of requests is 100.

<HttpRuntime maxRequestLength = "4096" executionTimeout = "60" appRequestQueueLimit = "100"/>

6. <pages>

Purpose: Identify page-specific configuration settings (such as whether to enable session Status, view status, and whether to detect user input ). <Pages> statements can be made at the computer, site, application, and subdirectory level.

Example: do not check whether there is potential dangerous data in the content entered by the browser (Note: This item is checked by default. If you do not check, 1. encode or verify user input). When you send a page from the client, the encrypted view status is checked to verify that the view status has been tampered with on the client. (Note: This item is not verified by default)

<Pages buffer = "true" enableViewStateMac = "true" validateRequest = "false"/>

7. <sessionState>

Purpose: Configure session Status settings for the current application (for example, whether to enable session Status and the location where session status is saved ).

Example:

<SessionState mode = "InProc" cookieless = "true" timeout = "20"/>
</SessionState>

Note:

Mode = "InProc" indicates that the session status is stored locally (you can also choose to store the session status on a remote server or SAL server or not enable the session status)

Cookieless = "true" indicates that session status is enabled if the user's browser does not support cookies (the default value is False)

Timeout = "20" indicates the number of minutes in which the session can be idle.

8. <trace>

Purpose: configure the ASP. NET tracking service, which is mainly used for program testing to identify errors.

Example: The default configuration in Web. config is as follows:

<Trace enabled = "false" requestLimit = "10" pageOutput = "false" traceMode = "SortByTime" localOnly = "true"/>

Note:

Enabled = "false" indicates that tracing is not enabled; requestLimit = "10" indicates the number of Trace Requests stored on the server.

PageOutput = "false" indicates that the trace output can only be accessed through the tracking utility;

TraceMode = "SortByTime" indicates that trace information is displayed in the order of processing traces.

LocalOnly = "true" indicates that the trace Viewer (trace. axd) is used only for the host Web server.

Iii. custom Web. config file configuration section

The configuration section of the custom Web. config file consists of two steps.

First, declare the name of the configuration section and the name of the. NET Framework class that processes the configuration data in the section between the <configSections> and </configSections> labels at the top of the configuration file.

Second, make actual configuration settings for the declared section after the <configSections> area.

Example: Create a storage database connection string

<Configuration>
<ConfigSections>
<Section name = "etetction" type =" System. Configuration. NameValueFileSectionHandler, System, Version = 1.0.3300.0, Culture = neutral, PublicKeyToken = b77a5c561934e089 "/>
</ConfigSections>

<Deleetask>
<Add key = "scon" value = "server = a; database = northwind; uid = sa; pwd = 123"/>
</AppSettings>

<System. web>
......
</System. web>
</Configuration>