asp.net - How to stop a 500 .net error created calling the 500 error page -

This is an interesting one for you.

I have a custom 500.aspx setup that is called when 500 errors occur in my application. 500.aspx also sends me an email with error details.

I have seen a small problem.

If you try to attack Xs attack on 500.aspx, then 500 pages are not called.

This is obviously some kind of logic problem.

In fact, Microsoft itself is suffering from the problem.

View this

Itemprop = "Text">

If you try any xss attack on any page, the custom error page will not be asked (with the XSS in the query string here).

This behavior seems deliberately to prevent the death of an attack in her tracks. Even error messages point to this behavior:

The request validation has detected potentially hazardous customer input value, and the request process has been revoked .

The only functional method for verification and handling and handling errors in your global world is visible on Application_Error.