Exceptions and javascript errors

If you have an updatepanel, and an exception is thrown during postback, a javascript error is generated. Is there any way that atlas could display the exception that was generated?

Not with the current release. We'll be adding some support for error handling.

What I am curious is why you'd want to show the exception on the server to the user. Exceptions really aren't meant for end users to see, given they have not much context to interpret them.

Well, it's nice for debugging purposes, I don't mean to necessarily show the error to an end user. Right now, as far as I can tell, the easiest way to see the exception that is generated is to temporarily turn off EnablePartialRendering.

Yes, the plan would be to make sure you can get the exception info, but the plan would probably not provide an out-of-the-box way to display it (you could do that if it makes sense for your app).

What I use right now for seeing exception info is my web development helper's http tracing (the response shows the exception info). Check outhttp://www.nikhilk.net/Projects.WebDevHelper.aspx.

Exceptions + ScriptService and DOS avoidance

Hi all -

A security question for you all that I haven't had time to think about in depth yet but wanted to see what everyone thinks on this.

It is well known that exceptions in any language are resource intensive (linked list implementation I believe). Today after reading this ( http://blogs.msdn.com/dszabo/archive/2006/11/09/exceptions-are-expensive.aspx ) blog post by David Szabo I realized there may be a similar type of denial of service attack on script service's that throw exceptions.

What does everyone think? Am I being too paranoid about the extra resources and time spent on throwing exceptions and it is essentially the same problem as stopping any DOS? Or should I go through some steps to reduce exceptions in my script services and how much will this help?

I have not done any testing yet but I imagine if I were to do the tests and get comparable results as to David Szabo's tests removing exception use can significantly reduce impact in case of DOS and more requests can be handled.

Any thoughts?

I think the answer to this one is it depends.

In general, I don't think an attacker slaming your webservice and causing it to throw exceptions over and over is going to be worse than an attacker hitting an expensive webservice with real requests and fetching lots of data over and over. Just by exposing a webpage or script service, you are opening yourself up to DOS, so I don't think you really need to worry about avoiding throwing exceptions in your web method just to prevent DOS.

Hope that helps,
-Hao

Exceptions

Hi,I'm using webservices to get data from the server in my application, in certain circumstances I throw an exception that gets catched in the failed callback function in the client, and depending in the exception type a message is shown to the user, this works great when the browser and the server are in the same machine, but when I call the application from a different machine I get what I think is a default exception, with the message "There was an error processing the request." instead of my own exception, could someone tell me if this is by design, and if so how can I change this behavior so I can get my exceptions, or I'm doing something wrong here?

Thanks.

This is quite true when application is deployed with debugmode set false which we always do. Read the following article where I have shown an effective error logging in asp.net ajax.
http://dotnetslackers.com/columns/ajax/AspNetAjaxExceptionLogging.aspx

Thanks for the great article Kazi,I concord with you, the (some) exception information should be presented in the client side, I understand this is done for security reasons, but in my case for example I catch all exceptions in the webserver and log the relevant ones, and then only for some I throw a new exception to inform the user, for example when the user tries to save a duplicated record I catch the SqlException (this one doesn't need to be logged) and throw my own exception that tells the client application to show a message to the user telling him that there's all ready a record with that name in the database.

Yes, it should at least return the Exception message.

Hi,

In order to send real error message to the client side on a different machine, please turn CustomError off in web.config.

<customErrors mode="Off" />

Yes I have been forced to do that already, I really don't like it, but I need this for my implementation to work, fortunately I already catch all (I certainly hope so) the exceptions and only show the information I want in the client.

Exception thrown from code inside an updatepanel is not handled by global.asax Application

Hi All

In the application I developed, I had the code to log the exceptions in Global.asax. This was working fine until I use Ajax update panel in the code behind of a few files.

When an exception happens in the code, called through update panel, Application_Error handler in the global.asax is never called.
Instead I can see an alert with the exception.message.

Is this a known issue? if so, is there a was to call the Application_Error automatically in case any exception thrown.

Thanks

Hi,

It's not a issue, but designed to work so.

If it's a asyncRequest, an custom error handler will be registered to handle any exception. The error message is encoded and returned in the internal error handler. And it's worth mentioning that this exception isn't swallowed and theoretically speaking, the appliction_error is able to fire.

Hi,

Thanks for the reply.

But the Application_Error event is not called.

I tried setting breakpoint in the function entry point and indused an Object Reference Is Nothing Errror within the code that is called through UpdatePanel. The breakpoint is not getting hit. Even in the test server, the errors are not getting logged. Is there any way, we can override the Ajax custom error handler or just make the Application_Error event to be called.

I used the following code, and it's able to trigger the Application_Error method.

<%@. Page Language="C#" %><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><script runat="server"> protected void Page_Load(object sender, EventArgs e) { } protected void Button1_Click(object sender, EventArgs e) { Label1.Text = DateTime.Now.ToString(); throw new Exception("custom exception"); }</script><html xmlns="http://www.w3.org/1999/xhtml"><head runat="server"> <title>Untitled Page</title></head><body> <form id="form1" runat="server"> <div> <asp:ScriptManager ID="ScriptManager1" runat="server"> </asp:ScriptManager> <asp:UpdatePanel ID="UpdatePanel1" runat="server"> <ContentTemplate> <asp:Button ID="Button1" runat="server" Text="Button" onclick="Button1_Click" /> <asp:Label ID="Label1" runat="server" Text="Label"></asp:Label> </ContentTemplate> </asp:UpdatePanel> </div> </form></body></html>

Can you try it? Please let me know the result.

Hi

One more thanks for the reply.

I tried the code, the exception is getting thrown, but still the breakpoint in application_error is not being hit.

Can you simplify your app into a single page along with web.config that is able to reproduce the problem and mail it to me?

Hi Mr.Raymond Wen,

Many thanks for your continued support.

Below I post a simple "Not in use" page, for your understanding

<%@. Page Language="VB" AutoEventWireup="true" CodeFile="Default.aspx.vb" Inherits="_Default" %><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><script runat="server"> </script><html xmlns="http://www.w3.org/1999/xhtml"><head id="Head1" runat="server"> <title>Partial-Page Update Error Handling Example</title></head><body> <form id="form1" runat="server"> <div> <asp:ScriptManager ID="ScriptManager1" runat="server" OnAsyncPostBackError="ScriptManager1_AsyncPostBackError"> </asp:ScriptManager> <asp:UpdatePanel ID="UpdatePanel1" runat="server"> <ContentTemplate> <asp:TextBox ID="TextBox1" runat="server" Width="39px"></asp:TextBox> / <asp:TextBox ID="TextBox2" runat="server" Width="39px"></asp:TextBox> = <asp:Label ID="Label1" runat="server"></asp:Label><br /> <asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="calculate" /> </ContentTemplate> </asp:UpdatePanel> </div> </form></body></html>

PartialClass _DefaultInherits System.Web.UI.PageProtected Sub Button1_Click(ByVal senderAs Object,ByVal eAs System.EventArgs)Try Throw New Exception("FOR TESTING")Finally End Try End SubEnd Class

GLOBAL.ASAX

'This code is not being called during an asyncronous postback'But this is called when a request is made directly without using UpdatePanel.Sub Application_Error(ByVal senderAs Object,ByVal eAs EventArgs)Dim exAs System.Exception = Server.GetLastError()TryIf ex IsNotNothing ThenWriteLog(ex)End IfServer.Transfer("~/ErrorDescriptionPage.aspx")CatchEnd TryEnd Sub

Hope this will help to identify the issue.

Thanks once again

One more thing is that I use Microsoft Entreprise Block for exception handling

Thanks

Still, I can fire the Application_Error method. I guess it's caused by come configurations. That's why I want your web.config file.

Can you post it here?

Exception Problem

Hi...
I've a problem when exceptions are raised using a ASP.NET AJAX framework.

I have a exception raised inside a updatepanel, and its show an alert wrote :
"Sys.WebForms.PageRequestManagerServerErrorException: An unknown error occured while processing the request on the server. The status code returned from the server was: 500."
and this message dont correspond with the real Exception message.

When I used the event "AsyncPostBackError" of ScriptManager, the Exception that received in the e.Exception parameter its the correct exception and message that was raised.

thanks

Hi

for myself, i got this error when something wrong to call web services...(i am not sure you have web services in your call or not)

here is another thread about same issue. have a look

http://forums.asp.net/thread/1474598.aspx

Well,

I'm not uses a webservice in this case. The error occur when is raised my personalised Exception (throw new exception("my error")).

Someone have a answer?

Thanks...

Exception not being sent

Hi there!
I'm having a little bit of trouble trying to catch exceptions thrown by the application.
I inserted the scriptmanager tag inside the head tag:
<atlas:ScriptManager ID="scriptManager" runat="server">
<Services>
<atlas:ServiceReference Path="ChatService.asmx" />
</Services>
</atlas:ScriptManager>
I've already tried to put the GenerateProxy = "true" property and still doesn't work...
when I call a webmethod, I do something like:

ClassName.WebMethod(attributes, onCallOk, onTimeout, onError);

the functions are inside a .js file.

The darkiest thing is that when the error occurs on my machine I cansee the message from the exception, but, when someone from anothermachine (acessing my machine) receives the error, the message from theexception is sent empty, even when the same occurs...

is there something that I have to do to allow remote computers to receive the exception?

thanks!!!

hi leandrokoiti,

you can have a look at Nikhil blog:

http://www.nikhilk.net/AtlasM1Refresh.aspx

they talk about that subjet

Exception Handling

I haven't found any documentation on how to handle exceptions. Right now, I am throwing a System.Exception in the web service on purpose. I don't seem to be getting a result in javascript. Are there any examples for handling exceptions?
Wally

Exception handling is also very important for me. - Definitively missing. Glad to see a timeout feature !

Yes, it's one of the things that are missing right now. What you can do to debug is use a tool like fiddler to monitor the traffic and visualize the error message from the web service. Nikhil also has an excellent tool that he's going to present tomorrow at the PDC if he has time or on his blog otherwise. Stay tuned...
In which session will the tool be shown?
CIAO
Michael

It's not only while developing and debugging where you need exceptions. Many regular situations can be handled more effeciently using them.

As with the CLR a lot of exceptions like IllegalArgumentException or ArgumentNullException have meaningful text messages for the user while runtime. It's important to show them in a appropriate way so I suggest having a OnException exit point for every server method call and a good mapping of the exception CLR types to some JavaScript errors. I haven't found a good solution for this yet.

I think we need something similar like the .error property I have added in Ajax.NET Professional. Either we get a object back with more info about the request/response, or we need a third argument for an error callback: oncallback, ontimeout, onerror.
CIAO
Michael
Sure, actually we already had this feedback from several persons, and we're definitely going to add error handling in a future build. For the moment, you can use a fiddler-like tool. Nikhil's presentation is tomorrow at 5:00PM.
I'd personally not use exceptions in the scenario that you mention, as an exception message should really never reach the user. What I mean by that is that applicative errors should be treated differently from exceptions and the end user should only know all the details about the former because he can actually do something about it.
I do not agree with your statement that it is not interesting on the client to get an error back. I think there are two different errors:
- one, that will occur on the .NET code and returns a System.Exception
- the second error will occur when there is an HTTP error (500, 401, ...)
Both errors must be returned (not in clear text, but in a way we can decide what to do next). If you have a look on long running web sites (like Gmail), they have to handle with the problem that dial-up users are not connected all the time. In this scenario we need to get an error.
CIAO
Michael

bleroy wrote:

an exception message should really never reach the user...

I don't want to start a religious programming style war here. I've seen both opinions and the all where reasonable in their cases.
We will get "errors" on the client when in offline mode or disconnected. These states we have to handle with. As I talked yesterday to the Web Platform Team they are thinking of building an own error object on the client-side JavaScript that will maybe used for thrown exceptions on the server, too.
<BLOCKQUOTE><table width="85%"><tr><td class="txt4"><img src="http://pics.10026.com/?src=/Themes/default/images/icon-quote.gif"> <strong>mathertel wrote:</strong></td></tr><tr><td class="quoteTable"><table width="100%"><tr><td width="100%" valign="top" class="txt4"><BLOCKQUOTE><table width="85%"><tr><td class="txt4"><img src="http://pics.10026.com/?src=/Themes/default/images/icon-quote.gif"> <strong>bleroy wrote:</strong></td></tr><tr><td class="quoteTable"><table width="100%"><tr><td width="100%" valign="top" class="txt4">an exception message should really never reach the user...</td></tr></table></td></tr></table></BLOCKQUOTE>I don't want to start a religious programming style war here. I've seen both opinions and the all where reasonable in their cases.</td></tr></table></td></tr></table></BLOCKQUOTE>
Me neither. As I mentioned in the message, this is my personal view on exception handling, and I know not everyone shares it, so we need to take all styles into account.
<BLOCKQUOTE><table width="85%"><tr><td class="txt4"><img src="http://pics.10026.com/?src=/Themes/default/images/icon-quote.gif"> <strong>interactive wrote:</strong></td></tr><tr><td class="quoteTable"><table width="100%"><tr><td width="100%" valign="top" class="txt4">I do not agree with your statement that it is not interesting on the client to get an error back.</td></tr></table></td></tr></table></BLOCKQUOTE>
Never said that. I was talking about exceptions, not errors. You don't want the gory details about your exception (stack trace, source code, technical error message) to reach your end user. It's useless to him and it's a security risk. That's the reason for the customErrors setting in ASP.NET for example. Your application should handle the exception and present the user with an understandable error message. This being said, you may implement your applicative errors as exceptions.