ASP.NET/IIS，何时< customHeaders>在web.config中添加到页面? [英] ASP.NET/IIS, When do <customHeaders> in the web.config get added to the page?

问题描述

在页面生命周期中的什么时候，web.config中的customHeaders会添加到页面中吗?一个MSN参考表明，在请求到达页面处理程序之前，已将标头添加到响应中.为什么没有清除标题，因为我可以看到在2个地方清除了标题?

At what point in the page lifecycle do customHeaders in the web.config get added to the page? One MSN reference showed headers being added to the response before the request got to the page handler. Why are none of the headers cleared since I can see headers being cleared in 2 places?

我可以在我们的页面模板之一中看到OnInit覆盖后面的代码:Response.ClearHeaders();Response.AppendHeader("Cache-Control"，"no-store");

I can see in one of our page templates code behind in the OnInit override: Response.ClearHeaders(); Response.AppendHeader("Cache-Control", "no-store");

web.config中的标题

The headers in the web.config

<customHeaders>
    <clear />
    <add name="X-XSS-Protection"...etc

呈现的页面响应标头同时具有"Cache-Control"和"X-XSS-Protection".由于.NET代码和web.config都清除了标头，因此我希望其中一个清除另一个标头，但这没有发生.

The rendered page response headers have both "Cache-Control" and "X-XSS-Protection" as well as others. Since .NET code and web.config both clear the headers, I would expect one to clear the other, but that is not happening.

如果有所不同，这是IIS 7.5的经典模式.

This is in IIS 7.5 in Classic mode if that makes a difference.

推荐答案

自定义标头将作为后处理的一部分添加.因此，您的ASP.NET代码将无法删除web.config中定义的自定义标头.

Custom headers are added as part of post-processing, when ASP.NET is done generating the response. So your ASP.NET code will not be able to remove the custom headers defined in web.config.

clear 元素清除自定义标头元素的配置-不会从响应本身清除标头.如果您继承了配置值(例如，如果machine.config中有customHeaders元素，并且您希望在站点级别覆盖它)，则这是一种重置配置的方法.

The clear element clears the configuration of the custom headers element-- it does not clear the headers from the response itself. It is a way of resetting the configuration if you have inherited configuration values (e.g. if there is a customHeaders element in machine.config and you wish to override it at the site level).

这篇关于ASP.NET/IIS，何时< customHeaders>在web.config中添加到页面?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！