Important Changes in ASP
ASP has undergone several important changes and enhancements to improve security and performance:
.gif)
Note To learn about new ASP features, see What's New in ASP.
- ASP Pages are Disabled by Default
- Using Parent Paths
- The "Templates Cached" Performance Counter
- Global.asa Events
- ASP Metabase Properties Removed
ASP Pages are Disabled by Default
.gif)
Important When you initially install IIS, the service is installed in a highly secure mode. Because IIS only serves static content by default, you must enable features such as ASP, ASP.NET, CGI, ISAPI, and WebDAV, if you need them. To enable these features, see Enabling and Disabling Dynamic Content in IIS Help, which is accessible from IIS Manager.
Using Parent Paths
The metabase setting, AspEnableParentPaths, is now set to 0 by default as a security precaution. This affects your application if it has a Web pages that contains the #include server-side include directive and uses ".." notation to refer to a parent directory.
The "Templates Cached" Performance Counter
The AspTemplatesCachedperformance counter now counts the number of cached ASP files, both on disk and in memory. In previous versions, because there was no disk-based caching, this counter referred only to the in-memory cache. There is also a new counter called AspInMemoryTemplatesCached that reflects the number of ASP pages in the memory cache.
Global.asa Events
Earlier versions of ASP executed events in the security context (or user identity) of the host process because during these events there is no user context. This caused problems such as access denied errors when writing to a file in the Session_OnEnd event. ASP, by default, now runs the global.asa events, Application_OnEnd Event and Session_OnEnd Event, anonymously. This can be controlled by the metabase setting, AspRunOnEndAnonymously.
ASP Metabase Properties Removed
The following metabase settings are no longer used by ASP, even though they are still in the metabase for compatibility with existing administration scripts: