Vulnerability in EPiServer.Forms
We are getting the following HttpExceptions being logged for 404 and 301 statuses :
The controller for path '' was not found or does not implement IController.
The BVNetwork 404 Handler has the following configuration
The /ErrorPage/NotFound action has the NotFoundPage attribute applied
From what Base controller your are inheriting your ErrorPageController?
It seems like MVC tries to route the request and cannot find a controller on it's own. Then it throws an exception, Episerver is logging it and only then the 404 handler is invoked.
I have seen similar log entries, however, in my case, the 404 handler still renders the error page nicely.
Thanks Praful and Stefan for your response
To clarify the 404 page is displaying correcting and configured URL redirects in the 404 Handler are working. However a large number of exceptions are still raised for both 404 and 301 statuses. Are you saying this is expected behaviour ?
ErrorPageController is inheriting from PageController<T>
Not expected, but known behaviour (see this issue).
Do you see this because of pages or static files? Because I see this only for static file requests, where as content requests get routed by Episerver and does not get logged like this.
For both page and static file requests.
Strangely the exceptions logged for page requests are those that have been configured for redirects in the 404 Handler. It seems Episerver logs the exception and then the 404 Handler does the redirect.
From the Readme on Git:
Important! errorMode needs to be set to Custom and existingResponse needs to be set to Replace, or the 404 page will not be shown, or will only be shown for URLs not ending with .aspx.
I see you have existingResponse set to Auto. What happens if you change it to Replace?
If you want to remove those "errors" from your logfil (They are not really errors now are they), check out this post: https://world.episerver.com/blogs/Henrik-Fransas/Dates/2014/3/How-to-remove-logging-of-404-request-from-EPiServers-logfiles/
I ended up turning off the BVN logging as per https://support.episerver.com/hc/en-us/articles/115004099183-Site-performance-impacted-by-BVN-404-handler
Wow, that was a very good way to kill performance.
the fastest sites are serving empty index.html file