web.config mistmatch between httpRuntime targetFramework and compilation targetFramework

Question

One of my devs noticed our web.config has a compilation targetFramework of 4.8 (matching the Project properties Application target framework). The azure app service / configuration / general settings page shows a framework version of 4.8 too however in web.config there is a also a httpRuntime targetframework of 4.5.1.

Not sure what setting / where configures this value or if this will matter or not. I thought it was not advised to go messing around editing the web.config manaully. The only real concern I have is the upcoming TLS 1.0 restriction with Azure and if this httpRuntime value is having any effect on the published site or not.

Answer 1

@SJ To add to what Lex shared, there are many settings with Azure Web Apps that can only be changed within the web.config file. We do recommend that you make a backup of the file before making any changes so you can revert as needed.

The httpRuntime target framework specifies the version of the .NET Framework that ASP.NET uses to process requests, while the compilation target framework specifies the version of the .NET Framework that the application is compiled against.

You could attempt to raise your httpRuntime to 4.8 and see what the result is or deploy your site code to a deployment slot/secondary web app and test the setting over there.

Overall, if your web app passes the ssllabs.com test and reports 1.2 or higher, you should be fine.

.NET 4.5 can support TLS 1.2. The default of anything lower than .NET 4.7 is TLS 1.1. If you need to access resources using TLS 1.2 you may get an error as it will be trying to use the default TLS version.