Vulnerability in EPiServer.Forms
I have a troublesome issue after upgrading to EPiServer 7 and MVC 4. We have a mechanism on the site which direct the user to a specific view or template depending on device. E.g. if you visit www.mysite.com/mypage from PC you will end up on mypage.aspx and if you visit the page from iPhone you will end up on mypage.iphone.aspx. Much like Display modes in MVC 4.
We are using both traditional webforms and MVC views. For MVC views this mechanism runs through our custom ViewEngine and for webForms we do the template selection on UrlRewrite event ConvertedToInternal.
Now the problem is after the upgrade this template/view mechnism stops working sometimes and returns the wrong view. PC view returns mobile view and vice versa.
The problem is really identical to the problem reported for Display Modes here http://aspnetwebstack.codeplex.com/workitem/280 but like I said this is our custom implementation and we are using it for web forms aswell which makes me doubt that the fix proposed MVC 4 display modes is our real problem. I'm wondering if this could have something to do with any new output caching mechanism in EPiServer 7/MVC 4.
The site is load balanced between to server and we run IIS 7. EpSierver cache is set to httpCacheExpiration="00:00:00".
Any advice on this and where I should look for cache settings?
In EPiServer 7 the handling of incoming request have been changed from UrlRewriteProviders to use Routing in .NET.
Are you using a custom FURL provider?
For backward compability if the site is using a custom UrlRewriteProvider then during upgrade we do not change UrlRewriteModule. So to use new routing the url rewrite module should be EPiServer.Web.RoutingUrlRewriteModule while if using a custom FURL provider the module will be EPiServer.Web.UrlRewriteModule.
In CMS7 the event to hook up to if you want to change templates is EPiServer.Web.TemplateResolver.TemplateResolved (or preevent TemplateResolving)
We are still using EPiServer.Web.UrlRewriteModule just becuase we have some functionality depending on it. But the functionality for changing template/view path is actually working fine until something happens in cache somewhere. The site can run for days without problems but then all the sudden is starts to show wrong view.
Could it be the MVC4 bug I mention earlier even though we are using UrlRewriteModule and change template paths on ConvertedToInternal? Or is this some output cache issue?
When I recycle the app pool the problem is temporarly gone.
If you have httpCacheExpiration then output caching should be disabled.
Does your custom FURL provider inherit EPiServer.Web.FriendlyUrlRewriteProvider? If so, it has an internal cache that default is 10 seconds if not configured. You can disable it by adding friendlyUrlCacheAbsoluteExpiration="0:0:0" on the add element for your FURL provider.
Otherwise I cant think of anything related to EPiServer that might cause this issue.
Thank you for the answer.
Just to be clear, this is what is definied in episerver.config:
<urlRewrite defaultProvider="HierarchicalUrlRewriteProvider"> <providers> <clear /> <add name="EPiServerFriendlyUrlRewriteProvider" description="EPiServer standard Friendly URL rewriter" type="EPiServer.Web.FriendlyUrlRewriteProvider,EPiServer" /> <add name="EPiServerIdentityUrlRewriteProvider" description="EPiServer identity URL rewriter" type="EPiServer.Web.IdentityUrlRewriteProvider,EPiServer" /> <add name="EPiServerNullUrlRewriteProvider" description="EPiServer bypass URL rewriter" type="EPiServer.Web.NullUrlRewriteProvider,EPiServer" /> <add name="HierarchicalUrlRewriteProvider" type="EPiServer.Web.HierarchicalUrlRewriteProvider,EPiServer" /> </providers> </urlRewrite>
And in web.config under <system.webServer>/<modules>:
<add name="InitializationModule" type="EPiServer.Framework.Initialization.InitializationModule, EPiServer.Framework" preCondition="managedHandler" /><add name="FirstBeginRequestModule" type="EPiServer.Web.InitializationModule, EPiServer" preCondition="managedHandler" /><add name="UrlRewriteModule" type="MySite.HttpModules.CustomUrlRewriteModule, MySite" preCondition="managedHandler" /><add name="ShellRoutingModule" type="EPiServer.Shell.Web.Routing.ShellRoutingModule, EPiServer.Shell" />
And CustomUrlRewriteModule inherits: EPiServer.Web.UrlRewriteModule
Does the friendlyUrlCache store view/template paths or any output content?
HierarchicalUrlRewriteProvider will cache a mapping from friendly url to "classic url" that is something like from '/Products/Alloy/' to '~/templates/page.aspx?id=12'.
The cache however is short time (by default 10 secs) so if that was the problem it should dissapear after some seconds. But to be sure that is not causing the problem you could disable caching by adding friendlyUrlCacheAbsoluteExpiration="0:0:0" by setting
type="EPiServer.Web.HierarchicalUrlRewriteProvider,EPiServer" friendlyUrlCacheAbsoluteExpiration="0:0:0" />