Chap 1

Pike · January 12th, 2012, 12:23 PM

I ran into Error Message 404.8 following along in chapter 1 the first time I tried to view in my browser the first page I had created with webmatrix. I couldnt find anything in the book about it and I couldnt find a thread here yesterday with a fix. I figured I would save the next person the hassle of tracking a solution down.

The error message description was "The request filtering module is configured to deny a path in the url that contains a hiddensegment section". My requested url was http://localhost:333963/App_Data/page.cshtml

I found the general solution here:

http://support.microsoft.com/kb/942047

This is what I did to correct mine on both my desktop and laptop:

1. Clicked start and searched for applicationhost.config
2. Right click on applicationhost.config and select properties to find and copy path.
3. Click Start, type Notepad in the Start Search box, right-click Notepad, and then click Run as administrator.
4. On the File menu, click Open, and paste the path and click open (make sure you are viewing all files not just .txt)
5. Select and open ApplicationHost.config
6. In the ApplicationHost.config file search (crtl-F) for "hidden" or "hiddensegments" which will locate the <hiddenSegments> element.
7. Microsoft says in the <hiddenSegments> element, you can either delete the entry that matches the directory that is specified in the requested URL.

Instead of deleting code I edited the line to read:



8. On the File menu, click Save.
9. Exit Notepad.

Hope that helps someone.

Imar · January 12th, 2012, 01:50 PM

Hi there,

While your fix does work, it's far from the ideal solution. The short explanation is: move page.cshtml out of App_Data into the root of the site, or any folder other than the root (and some other reserved folders explained in Chapter 1).

The long explanation:

App_Data is designed to store data that is only accessible to your code that runs on the server. You use it for databases, XML files and other files you want to read from code but not expose to your end users directly over HTTP. By default, as you found out, access to this folder is blocked. By removing this restriction, anyone can download files from that folder, even files that may contain sensitive information such as databases.

So, storing web files in App_Data and then opening that folder up to end users is not the right way to do it if you want to build a secure system. Instead, revert your changes in the config file, move page.cshtml to the root or some other folder and you're good to go.

Hope this helps.

Cheers,

Imar

Pike · January 12th, 2012, 07:24 PM

That makes a lot more sense - it worked great.