Should custom Error pages in IIS7 return the error status code originally associated with them?

Question

I am trying to use custom error pages using redirects in IIS7. This is my code:

<httpErrors>
    <remove statusCode="404" subStatusCode="-1" />
    <error statusCode="404" prefixLanguageFilePath="" path="/Pages/NotFound" responseMode="ExecuteURL" />
</httpErrors>

As you can see the line <remove statusCode="404" subStatusCode="-1" /> resets the status code and when I hit the page I get a Status Code of 200 for a page that is not found. Is that really the right way to handle pages that are not found?

My understanding is that I would want to return 404 errors even when I show a nice page from within my site for pages that don't exist. I know this is an edge case but I am trying to cover all of my bases.

the page I am redirecting to is an .aspx page and has c# code behind it. In the page I am putting:

protected void Page_Load(object sender, EventArgs e)
        {
            Response.Status = "404 Not Found";
        } 

This code does not appear to actually do anything though. Does anyone have any guidance on if I should be returning 404 Errors and if so how to do it? Thanks.

Answer 1

When you do a redirect for a page not found error, it is essentially exception handling by the web server. You will get a 200 response, but just a nice page saying - "Hi, what you are looking for is not here." Without a redirect/custom error page, the browser is left up to its own devices to see the 404 and display some type of error to the end user. The 404 error could be logged in this instance as the error had to occur to get the redirect. You shouldn't need to change your response codes unless you have a reason to (i.e., unauthorized content request you may want to return a 404 instead of saying unauthorized).

As for your code, it should read this:

response.StatusCode = "404" 

However, I am curious that if you send a 404 error out on your custom 404 error page, if you will get in some crazy loop in IIS. 404 -> Custom Error Page (returns 404) -> Custom Error Page (returns 404) -> etc. never really tried that before.