web config - What is the difference between customErrors and httpErrors?

Question

What is the difference between the customErrors and httpErrors sections of the web.config file in ASP.NET MVC applications?

What are the guidelines for using each section?

Answer 1

*Updated April 2016

The customErrors attribute is used when the .net code is throwing an exception (404, 403, 500 etc) and the httpErrors attribute is used when IIS itself is throwing an exception.

• /myfakeextensionslessurl --> httpErrors 404
• /myfakeaspsx.aspx --> customErrors 404
• /myfakeimage.jpg --> httpErrors 404
• /throw500.apx --> customErrors 500
• /throw500 --> customErrors 500

There are a lot of pitfalls trying to configure this correctly. So if you are looking for a quick example, the best 2 options you have are:

Example 1: Using html pages

<system.web>
  <customErrors mode="RemoteOnly" defaultRedirect="/Error500.html" redirectMode="ResponseRewrite">
    <error statusCode="403" redirect="/Error403.html" />
    <error statusCode="404" redirect="/Error404.html" />
    <error statusCode="500" redirect="/Error500.html" />
  </customErrors>
</system.web>
<system.webServer>
  <httpErrors errorMode="DetailedLocalOnly" existingResponse="Auto">
    <remove statusCode="403" />
    <remove statusCode="404" />
    <remove statusCode="500" />
    <error statusCode="403" responseMode="File" path="Error403.html" />
    <error statusCode="404" responseMode="File" path="Error404.html" />
    <error statusCode="500" responseMode="File" path="Error500.html" />
  </httpErrors>
</system.webServer>

Example 2: using aspx pages

<system.web>
  <customErrors mode="RemoteOnly" defaultRedirect="/Error500.html" redirectMode="ResponseRewrite">
    <error statusCode="403" redirect="/Error403.aspx" />
    <error statusCode="404" redirect="/Error404.aspx" />
    <error statusCode="500" redirect="/Error500.aspx" />
  </customErrors>
</system.web>
<system.webServer>
  <httpErrors errorMode="DetailedLocalOnly" existingResponse="Auto">
    <remove statusCode="403" />
    <remove statusCode="404" />
    <remove statusCode="500" />
    <error statusCode="403" responseMode="ExecuteURL" path="Error403.aspx" />
    <error statusCode="404" responseMode="ExecuteURL" path="Error404.aspx" />
    <error statusCode="500" responseMode="ExecuteURL" path="Error500.aspx" />
  </httpErrors>
</system.webServer>

And in the aspx error pages you need to do something like this (example 404 page):

<% 
    Response.StatusCode = 404;
    Response.TrySkipIisCustomErrors = true;
 %>

Note: Using extension less urls in the customErrors section is not possible!. (without hacks)

One work around is to disable custom errors and let http errors handle the custom page. A friend has created such setup, when I find some time, I will share the code.

Background

A good custom error page will:

1. Show the real exception when you visit the problem page locally
2. Show a custom page when you visit the problem page remotely
3. Will not redirect, but simply show the error page content (because of seo reasons)
4. Will show the correct status code

So to clarify some options in our config:

1. <customErrors mode="RemoteOnly". You can specify here: On, Off, RemoteOnly.

   • On = Always show custom error pages
   • Off = Always show the real error
   • RemoteOnly = Show the error locally, but show the custom error page remotely. So we want RemoteOnly for statement 1

2. <customErrors redirectMode="ResponseRewrite". You can specify here: ResponseRedirect or ResponseRewrite. The ResponseRedirect mode will redirect the error page to the custom error page. For a link crawler (SEO), this will result in 302 -> 500, but you want the link crawler to get a 500 error.

3. <httpErrors errorMode="DetailedLocalOnly". This the equivalent of the customErrors mode. Options that you have: Custom, Detailed, DetailedLocalOnly.

A good blog post which helped me a lot is: http://benfoster.io/blog/aspnet-mvc-custom-error-pages