Vulnerability in EPiServer.Forms
Is it possible to specify files or a folder that will not be handled by EPIServer at all, so they can be shown in case of severe errors such as when the database is not available?
It sounds like your're looking to deal with 500-errors. The IIS can be configured to handle this and show, for example, a static html page. Google your IIS version + custom 500 error page and you should find plenty of information...
That is correct and I think I found the correct web.config configurations to handle this, however certain critical errors like DB problems prevents EPIServer components from initializing causing everything to fail. So essentially, I want to create an area on the site that EPIServer will not touch
Yes, I understood that. That's why you should let IIS handle the error. In web.config you configure customErrors and points to static html files. That way EPiServer is not involved at all. It's just your IIS serving static content to the client. Do something like this in web.config: <customErrors mode="On"><error statusCode="500" redirect="/Custom500.html" /></customErrors>
I'm pretty sure I already tried this and found that it wasn't quite enough.
I have this:
<system.webServer> <httpErrors errorMode="Custom"><error statusCode="500" prefixLanguageFilePath="" path="/StaticPages/error500.html" responseMode="ExecuteURL"/>
And also as you specified:
<customErrors mode="On"> <error redirect="/StaticPages/error500.html" statusCode="500"/> </customErrors>
Now if I for example turn off MSSQL, then it does seem like IIS is handling the error and invokes my Application_Error event causing a connection level error. I can now by code redirect or use the web.config settings. But the problem is, that any sub folder or application will inherit the EPIServer settings which seems to internally load EPIServer. And then even the static page above will invoke a connection level error again until IIS gives up.
I presume this setting among others causes it
<section name="staticFile" type="EPiServer.Configuration.StaticFileSection, EPiServer.Configuration" allowLocation="true"/>So instead of just redirecting to another site completely unrelated to this app_pool/server, I was hoping that I somehow through web.config could configure a specific folder to be ignored by EPI.
Anyone have any solution to this?
Struggling with the same problem myself (i.e. when MVC EPiServer site lose connection to DB IIS isn't able to display my custom static 500 error HTML page.)