h5bp / server-configs-iis Goto Github PK

Should these have the Keep-Alive attribute?

<httpProtocol allowKeepAlive="true">

doesn't seem to work - in IIS 7.5 and 8 at least.

Perhaps replace with the URL Rewrite solution provided here?

https://stackoverflow.com/questions/7947420/iis-7-5-remove-etag-headers-from-response

@ChrisMcKee Is it worth continuing to support IIS 6, or should we drop it in the near future ?

As far as I can tell, the mainstream support for IIS 6 (which comes with Windows Server 2003) has ended in 2010, while the extended support will end in 2015.

The .htaccess version of this rewrite rule contains a check that the requested file does not exist before rewriting (the !-f part in RewriteCond %{REQUEST_FILENAME} !-f).

This check is needed to avoid rewriting if the file exists on the server. Otherwise it will return 404, example below.
jquery-1.11.3.js => jquery-1.11.js

This can be solved by using a condition of the rewiterule, full example below:

<rewrite>
    <rules>
        <rule name="Cachebusting">
            <match url="^(.+)\.\d+(\.(js|css|png|jpg|gif)$)" />
            <conditions>
              <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
            </conditions>
            <action type="Rewrite" url="{R:1}{R:2}" />
        </rule>
    </rules>
</rewrite>

removed from all other configs as well. No reason for it to be there still.

chrome=1 can be removed in the snippet:

Google's ChromeFrame has been discontinued and is no longer available.

I believe that the text/javascript is obsolete.

Google officially announced that they've decided to retire Chrome Frame: http://blog.chromium.org/2013/06/retiring-chrome-frame.html.

@ChrisMcKee maybe postponed removing the Chrome Frame HTTP header hint until after IIS gets to a more stable release, v1.0.0 ?

As a developer I tend to have trouble sometimes going through and cherry picking the nodes that have changed from the web.configs that are in the IIS repo.

I tend to use Coldfusion and Node JS on my IIS 7.5-8.5. When going through the IIS repo, I normally copy nodes from the .net 4 webforms, but worry that I might miss something in a future release as this project continues.

In all sample web.configs, in the Cachebusting section, there is a link that leads to a nonexistent wiki page.

To understand why this is important and a better idea than all.css?v1231,
read: github.com/h5bp/html5-boilerplate/wiki/Version-Control-with-Cachebusting

There is a "cachebusting" link in the pages navigation but that links to other documentation and I have yet to find the content I'm supposed to read.

Please update the link and consider updating the content on the wiki page to point more specifically to where the actual information is or additionally include an executive summary plus the link to the external information.

Thanks for all your work on this excellent project!

It would be great to have possibility of including this repo via npm - use case

Removing the ETag header is written twice in the web.config.
The first one is with custom HTTP header:

And the second one is with URL rewrite.

Besides from being duplicate, the first option doesn't actually work:
http://stackoverflow.com/a/1250987/601179
(And I verified it today)

BTW, for IIS 8 there is a new way:
http://stackoverflow.com/a/26789473/601179

Libraries are using new WOFF 2 font format. Older IIS does not know about mime type for the .woff2 files.

Specification: http://www.w3.org/TR/WOFF2/

As of march 2016 the proposed mime type is font/woff2.

Add support for files .webmanifest especially to support site.webmanifest use to define favicon, tab icon, app icon, etc.

It use on html head like this:

<link rel="manifest" href="site.webmanifest">

Suggested web.config entry is:

<mimeMap fileExtension=".webmanifest" mimeType="application/manifest+json" />

SOURCE: https://stackoverflow.com/questions/49566446/how-can-i-have-iis-properly-serve-webmanifest-files-on-my-web-site

I noticed that the mobile boilerplate includes a manifest.webapp file but this config doesn't actually support that file type.

<remove fileExtension=".webapp" />
<mimeMap fileExtension=".webapp" mimeType="application/x-web-app-manifest+json; charset=UTF-8" />

The issue is you receive a blank page when you try to run a child application of another IIS app (website) both of which use the same H5BP web.config.

The problem lies in the customheaders section of system.webServer. Unless we remove the header first in our child application we cannot add the same header name. If we do that, it results in blank page render, which is extremely difficult to troubleshoot (I wonder how no one ever experienced that before).

So the solution is to first remove the header (which for some reason some headers already do) and then add it back again.

If we don't do that we have to watch out for these blank pages and errors and have to resort to

which we don't necessarily want.

I'll be creating a pull request shortly.

https://github.com/h5bp/server-configs-iis/blob/master/dotnet%203/web.config#L293

First, thank you for this project. Very helpful.

Not to pick nits, but I suspect this comment isn't quite correct:

<staticContent>
<!-- Remove ETAG IN IIS >8 ; for IIS 7/7.5 see the Rewrite rules (bigger description of why you might remove etag down there aswell)
<clientCache setEtag="false"/>
-->

Should probably read: ETAG IN IIS >=8

web.config is a tricky thing to rely on simple copy-pasting. I'm trying to read this line by line and look up the options. I mostly understand what-it-does part, but the why-it-is-needed part is not clear.

Default requestValidationMode value is 4.0. Are you setting it 2.0 for backward compatibility?

Anyway, It would be great to have line by line docs or html representation of this with side notes.

    <!-- enableVersionHeader -- Security through obscurity. Removes X-AspNet-Version HTTP header from the response -->
    <!-- relaxedUrlToFileSystemMapping -- Optional. Set this if you're upgrading from older versions of ASP. See: http://www.asp.net/whitepapers/aspnet4/breaking-changes#0.1__Toc256770147 -->
    <!-- requestPathInvalidCharacters -- Allow zombie DOS names to be captured by ASP.NET (/con, /com1, /lpt1, /aux, /prt, /nul, etc) -->
    <!-- targetFramework -- ??? -->
    <httpRuntime enableVersionHeader="false"
                 relaxedUrlToFileSystemMapping="true"
                 requestPathInvalidCharacters="" 
                 requestValidationMode="2.0" 
                 targetFramework="4.5"/> 

@alrra I'm unable to commit to this repo.

"You are editing a file in a project you do not have write access to. We are forking this project for you (if one does not yet exist) to write your proposed changes to. Submitting a change to this file will write it to a new branch in your fork so you can send a pull request."