Share via

httpRuntime Element (ASP.NET Settings Schema)

  • Article

Configures ASP.NET HTTP run-time settings that determine how to process a request for an ASP.NET application.

configuration Element (General Settings Schema)
  system.web Element (ASP.NET Settings Schema)
    httpRuntime Element (ASP.NET Settings Schema)

<httpRuntime
   apartmentThreading = "[True|False]"
   appRequestQueueLimit = "number"
   delayNotificationTimeout = "number"
   enable = "[True|False]" 
   enableHeaderChecking = "[True|False]" 
   enableKernelOutputCache = "[True|False]" 
   enableVersionHeader = "[True|False]" 
   encoderType = "string"
   executionTimeout = "number" 
   maxQueryStringLength = "number"
   maxRequestLength = "number" 
   maxUrlLength = "number"
   maxWaitChangeNotification = "number" 
   minFreeThreads = "number" 
   minLocalRequestFreeThreads = "number" 
   relaxedUrlToFileSystemMapping = "[True|False]"
   requestLengthDiskThreshold = "number" 
   requestPathInvalidCharacters = "string"
   requestValidationMode = "[2.0|4.0]"
   requestValidationType = "string"
   requireRootedSaveAsPath = "[True|False]"
   sendCacheControlHeader = "[True|False]" 
   shutdownTimeout = "number"
   useFullyQualifiedRedirectUrl = "[True|False]" 
   waitChangeNotification = "number" />

Attributes and Elements

The following sections describe attributes, child elements, and parent elements.

Attributes

Attribute

Description

apartmentThreading

Optional Boolean attribute.

Enables apartment threading for classic ASP compatibility.

The default is False.

appRequestQueueLimit

Optional Int32 attribute.

Specifies the maximum number of requests that ASP.NET queues for the application. When there are not enough free threads to process a request, the requests are queued. Incoming requests are rejected with the error "503 - Server Too Busy" when the queue exceeds the limit that is specified in this attribute.

The default is 5000.

delayNotificationTimeout

Optional Int32 attribute.

Specifies the time-out in seconds for delaying notifications.

The default is 5 seconds.

encoderType

Gets or sets the name of a custom type that can be used to handle HTML and URL encoding.

ASP.NET uses the HttpEncoder type as the default handler for HTML and URL encoding tasks. To customize encoding behavior, you can create a class that inherits from the HttpEncoder type. In the configuration file for an application, you then set the EncoderType attribute of the httpRuntime element to the fully qualified string name of the custom type.

This attribute is new in the .NET Framework version 4.0.

enable

Optional Boolean attribute.

Specifies whether the application domain (AppDomain) is enabled to accept incoming requests at the current-node and child-node level. If False, the application is effectively turned off.

The default is True.

enableHeaderChecking

Optional Boolean attribute.

Specifies whether ASP.NET should check the request header for potential injection attacks. If an attack is detected, ASP.NET responds with an error.

The default is True.

enableKernelOutputCache

Optional Boolean attribute.

Specifies whether output caching is enabled. This attribute is only relevant when Microsoft Internet Information Services (IIS) 6.0 or later is installed. The output caching configuration and type of request determines whether content can be cached.

To cache a response, the following criteria must be met:

  • Caching must be explicitly enabled by a page directive or by using the caching API.

  • Caching must have an expiration policy so that the kernel recognizes when to discard the response.

  • Caching does not have any variable headers or parameters.

  • Authentication is not required.

The default is True.

enableVersionHeader

Optional Boolean attribute.

Specifies whether ASP.NET should output a version header. This attribute is used by Microsoft Visual Studio 2005 to determine which version of ASP.NET is in use. It is not necessary for production sites and can be disabled.

Note

This attribute is not available in the .NET Framework 1.0.

The default is True.

executionTimeout

Optional Int32 attribute.

Specifies the maximum number of seconds that a request is allowed to execute before being automatically shut down by ASP.NET.

This time-out applies only if the debug attribute in the compilation element is False. Therefore, if the debug attribute is True, you do not have to set this attribute to a large value in order to avoid application shutdown while you are debugging.

The default is 110 seconds.

Note

In the .NET Framework 1.0 and 1.1, the default is 90 seconds.

maxQueryStringLength

Optional Int32 attribute.

The maximum length of the query string, in number of characters. The default is 2048.

The value of the MaxQueryStringLength property can be any integer, zero or larger. If the length of a query string exceeds the size limit, ASP.NET returns an HTTP 400 (Bad Request) status code.

Note

Extremely small values can make a Web site unusable.

There is also an IIS setting that controls query string length. See the maxQueryString attribute in Request Limits <requestLimits>.

maxRequestLength

Optional Int32 attribute.

Specifies the limit for the input stream buffering threshold, in KB. This limit can be used to prevent denial of service attacks that are caused, for example, by users posting large files to the server.

The default is 4096 KB. If the threshold is exceeded, a ConfigurationErrorsException exception is thrown.

maxUrlLength

Optional Int32 attribute.

The maximum length of the URL, in number of characters. The default is 260.

The value of the MaxUrlLength property can be any integer, zero or larger.

If the length of the request URL (which is the value of the Path property) exceeds the configured size limit, ASP.NET returns an HTTP 400 (Bad Request) status code.

Note

Extremely small values can make a Web site unusable.

maxWaitChangeNotification

Optional Int32 attribute.

Specifies the maximum number of seconds to wait from the first file change notification before restarting the AppDomain for a new request. Set this attribute to a number that is greater than the length of time to complete any file copy processes. File change notifications are combined based on the value of this attribute and the waitChangeNotification attribute.

The default is 0.

minFreeThreads

Optional Int32 attribute.

Specifies the minimum number of free threads to allow execution of new requests. ASP.NET keeps the specified number of threads free for requests that require additional threads to complete processing. The default is 8.

.

minLocalRequestFreeThreads

Optional Int32 attribute.

Specifies the minimum number of free threads that ASP.NET keeps available to allow execution of new local requests. The specified number of threads is reserved for requests that are coming from the local host, in case some requests issue child requests to the local host during processing. This helps to prevent a possible deadlock with recursive reentry into the Web server.

The default is 4.

relaxedUrlToFileSystemMapping

Optional Boolean attribute.

Indicates whether the URL in an HTTP request is required to be a valid Windows file path.

The RelaxedUrlToFileSystemMapping property determines how the URL in an incoming HTTP request will be validated. If this property is false, the URL is validated by using the same rules that determine whether a Windows file system path is valid.

requestLengthDiskThreshold

Optional Int32 attribute.

Specifies the limit for the input stream buffering threshold, in kilobytes. This value should not exceed the maxRequestLength attribute.

The default is 80 KB.

requestPathInvalidCharacters

Optional String attribute.

A comma-separated list of characters that are invalid in a request path. The following list contains the default set of invalid characters:

<,>,*,%,&,:,\

requestValidationMode

Optional Int32 attribute.

Gets or sets a version number that indicates which ASP.NET version-specific approach to validation will be used.

The value that you assign to this property is not validated to match a specific version of ASP.NET. Any numeric value smaller than 4.0 (for example, 3.7, 2.9, or 2.0) is interpreted as 2.0. Any number larger than 4.0 is interpreted as 4.0. The default is 4.0.

requestValidationType

Optional String attribute.

Gets or sets the name of a type that is used to validate HTTP requests.

To customize ASP.NET request validation behavior, you can create a class that inherits from the RequestValidator type. In the configuration file for an application, you then set the requestValidationType attribute of the httpRuntime element to the fully qualified string name of the custom type

The default is the fully qualified name of the RequestValidator type that ASP.NET uses for validation

requireRootedSaveAsPath

Optional Boolean attribute.

Specifies whether the filename parameter in a SaveAs method must be an absolute path. The ASP.NET process must have permission to create files in the specified location.

The default is True.

sendCacheControlHeader

Optional Boolean attribute.

Specifies whether to send a cache control header, which is set to Private, by default. If True, client-side caching is disabled.

The default is True.

shutdownTimeout

Optional Int32 attribute.

Specifies the number of minutes that are allowed for the worker process to shut down. When the time-out expires, ASP.NET shuts down the worker process.

The default is 90 seconds.

useFullyQualifiedRedirectUrl

Optional Boolean attribute.

Specifies whether client-side redirects are fully qualified using the form "https://server/path", which is required for some mobile controls, or whether relative redirects are sent to the client instead. If True, all redirects that are not fully qualified are automatically converted to fully qualified form.

Note

If this attribute is set to False, some browsers might encounter issues when loading pages that are in cookieless sessions.

The default is False.

waitChangeNotification

Optional Int32 attribute.

Specifies the time, in seconds, to wait for another file change notification before restarting the AppDomain. Set this attribute to a number that is greater than the time between the updates of two file copy change notifications. File change notifications are combined based on the value of this attribute and the maxWaitChangeNotification attribute.

The default is 0 seconds.

Child Elements

None.

Parent Elements

Element

Description

configuration

The required root element in every configuration file that is used by the common language runtime and the .NET Framework applications.

system.web

Specifies the root element for the ASP.NET configuration settings in a configuration file and contains configuration elements that configure ASP.NET Web applications and control how the applications behave.

Remarks

The httpRuntime element configures ASP.NET HTTP run-time settings that determine how a request for an ASP.NET application is processed. The .NET Framework provides a number of different run-time hosts, including the ASP.NET run-time host. When a request comes in, ASP.NET loads the run-time setting into the process that is to handle the request. ASP.NET also creates an application domain for each Web application that will run on a Web server.

Default Configuration

The httpRuntime element is not explicitly defined in the Machine.config file or in the root Web.config file. However, the following settings are the default values as initialized by the system. If you need to customize this section you must create it in your configuration file and define only those attributes that need customization.

<httpRuntime 
   enableHeaderChecking="true"
   apartmentThreading="false"
   appRequestQueueLimit="5000"
   delayNotificationTimeout="5"
   enable="true"
   enableKernelOutputCache="true"
   enableVersionHeader="true"
   encoderType = "System.Web.Util.HttpEncoder"
   executionTimeout="110"
   maxQueryStringLength = "2048"
   maxRequestLength="4096"
   maxUrlLength = "260"
   maxWaitChangeNotification="0"
   minFreeThreads="8"
   minLocalRequestFreeThreads="4"
   relaxedUrlToFileSystemMapping = "False"
   requestLengthDiskThreshold="80"
   requestPathInvalidCharacters = "<,>,*,%,&,:,\"
   requestValidationMode = "4.0"
   requestValidationType = "System.Web.Util.RequestValidator"
   requireRootedSaveAsPath="true"
   sendCacheControlHeader="true"
   shutdownTimeout="90"
   useFullyQualifiedRedirectUrl="false"
   waitChangeNotification="0" />

Example

The following example demonstrates how to specify HTTP run-time parameters for an ASP.NET application.

<configuration>
  <system.web>
  <httpRuntime maxRequestLength="4000"
    enable = "True"
    requestLengthDiskThreshold="512"
    useFullyQualifiedRedirectUrl="True"
    executionTimeout="45"
    versionHeader="1.1.4128"/>
  </system.web>
</configuration>

Element Information

Configuration section handler

HttpRuntimeSection

Configuration member

HttpRuntime

Configurable locations

Machine.config

Root-level Web.config

Application-level Web.config

Virtual or physical directory–level Web.config

Requirements

Microsoft Internet Information Services (IIS) 5.0 or later.

The .NET Framework 1.0 or later.

See Also

Reference

system.web Element (ASP.NET Settings Schema)

configuration Element (General Settings Schema)

System.Configuration

HttpRuntimeSection

HttpRuntime

Concepts

Caching ASP.NET Pages

ASP.NET Configuration File Hierarchy and Inheritance

Securing ASP.NET Configuration

Other Resources

General Configuration Settings (ASP.NET)

ASP.NET Configuration Settings

ASP.NET Web Site Administration