SOLO.config File Options

Several configuration entries related to database maintenance, HTTP request validation, and error reporting are shared between the classic ASP and ASP.NET portions of SOLO Server and are located in the SOLO.config file. The file is an XML file with a root element of <SOLOSettings> and the following child elements:

DatabaseEnabled

True/False as to whether the database is on or offline.

MaintenanceEnableIPAddr

The range of IP addresses that can enable/disable the database. Entered in the following format IP:Mask with each entry separated by a "|" character. The IP address or subnet of your corporate office should be used for this parameter.

MaintenanceMessage

Message to display when the database is taken offline for maintenance.

HttpRequestValidatorConfiguration

Configuration section for the HttpRequestValidator component, which performs additional request validation on the classic non ASP.NET resources to prevent cross site scripting attacks. Typically no changes are needed to this section if installing with SOLO Server Build 1.6.0.71 or later into a fresh website or virtual directory using the "Specify Website Configured in IIS" option of the installer. If this is not the case and SOLO Server is installed in a subdirectory rather than in the web root, uncomment the commented Folder element under the AllowedPaths element as well as its closing element, and update the Name attribute with the subfolder path to the SOLO root. For example, if the path to SOLO Server is http://www.company.com/solo/, the Folder element should be <Folder Name="SOLO">.

HttpErrorHandlerConfiguration

Configuration section for the HttpErrorHandler component, which handles any unhandled exceptions thrown in the .NET portions of SOLO Server. Typically no changes are needed to this section if installing with SOLO Server Build 1.6.0.71 or later into a fresh website or virtual directory. The only changes that should be made to this section is the addition of any additional Email elements in the ReceiverEmails section. You may optionally remove the default entry for SOLOErrors@softwarekey.com if you do not want SOLO Server to send error notification emails containing diagnostic information (which may contain customer data) to our error logging system.

The MessageExclusions subsection lists error messages that are known to be harmless (automated scanner probes, malformed requests) and should not generate a notification email each time they occur. Each Exclusion's Value is matched against the exception message exactly, ignoring case, by default; adding Type="StartsWith" to an Exclusion instead matches any message beginning with that text, which is needed for messages where request-specific data (such as the submitted field name) is appended after a fixed prefix. Note that a Value written with a trailing space will not match, as surrounding whitespace is trimmed.

Every message in the error's exception chain is checked, from the reported error through each underlying error that caused it, so an Exclusion may be written against whichever message you recognize. For invalid-request errors the messages differ: the notification email's subject line shows the underlying message (for example, one beginning "A potentially dangerous Request."), while its Exception Message line shows the wrapper text "Invalid request data detected." An Exclusion matching any message in the chain suppresses the notification.

Changing Values in SOLO.config