403.14 Error When Trying to Access a WebAPI Route

Introduction

No, there’s no flying pigs, and Satan isn’t wearing a woolly hat, but this is a post about WebAPI (boooo!) I hit an “interesting” issue today, and felt a blog post was in order in case anyone else is bitten by this rather annoying “feature”.

I added a very simple route definition:

config.Routes.MapHttpRoute(
  name: "foo",
  routeTemplate: "{controller}/{name}",
  defaults: new { name = RouteParameter.Optional },
  constraints: new { controller = "foos" });

And a very simple controller:

namespace Bar
{
    using System.Web.Http;

    using Bar.Hypermedia;

    public class FoosController : ApiController
    {
        private readonly IFooService fooService;

        public FoosController(IFooService fooService)
        {
            this.fooService = fooService;
        }

        [HttpGet]
        public IEnumerable Root()
        {
            return this.fooService.GetFoos();
        }

        [HttpGet]
        public Foo Root(string name)
        {
            return this.fooService.GetFoo(name);
        }
    }
}

It couldn’t get much more simple – just a controller that returns a collection of Foos, or a single Foo, depending on whether the name of the Foo was specified. I fired up curl and getting a single Foo was fine, but browsing to /foos/ came back with:

HTTP Error 403.14 – Forbidden
The Web server is configured to not list the contents of this directory.

Err.. what?!

The Solution

The solution was easy – just ask a friendly neighbourhood ASP.Net WebAPI MVP to fix it for me 😉 Filip stepped up and confirmed all my code was fine, but after some head scratching noticed that I had my FoosController.cs inside a folder called Foos, and renaming that folder made the route work fine. It seems that if IIS/Asp.Net sees a folder that exactly matches the URL you’re asking for (/foos in this case) then it takes over and ignores any routes you have setup. Renaming folders would be a major pain in the backside, but luckily you can disable this behaviour by adding one line to the global.asax:

public class WebApiApplication : HttpApplication
{
    protected void Application_Start()
    {
        // Stop IIS/Asp.Net breaking our routes
        RouteTable.Routes.RouteExistingFiles = true;

        WebApiConfig.Register(GlobalConfiguration.Configuration);
    }
}

So many thanks to Filip for helping me solve this one – I’m sure I’d have lost time, and hair, trying to figure it out on my own. I’d consider this behaviour to be a bug, but I’m sure it’s actually a feature in someone’s mind. If only there was a better way to write HTTP APIs in .net…. 😉

Nancy v0.8.0 – Best Laid Plans..

TL;DR

Nancy v0.8.0 is out, loads of cool new features such as static content (so you *finally* don’t have to do it yourself :-P), basic authentication support, and CSRF protection, and enhancements to things like error handling (with fancy pants error pages) and the test framework. We also have a fantastic new logo by Nicolas Garfinkiel (codetothepeople.blogspot.com), and a new website – so go check out the Nancy site now 🙂

The plan..

Once v0.7.1 was out of the way the plan was simple – work on diagnostics, hopefully interfacing with the guys from Glimpse, and get v0.8.0 – the “diagnostics release” out within 6 weeks or so. But things didn’t go entirely to plan…

A very nice problem to have..

We knew Nancy was getting a bit of a following, but we didn’t anticipate the level, and the quality, of the community contributions. We received lots of feedback, lots of great suggestions, and lots and lots of pull requests – before we knew it v0.8.0 was already looking pretty feature rich, without the diagnostics work we intended to be the core part of it, and time was tick tick ticking by. So, after a certain Mark Rendle started referring to this release as our “Duke Nukem Forever” release, we decided people had waiting long enough for an update and we “re-scoped” v0.8.0 so we could release the growing list of improvements sooner rather than later.

Taking a look at a GitHub comparison it shows v0.8.0 consisting of:

  • 186 commits
  • 226 files changed / updated
  • 19 different contributors
So 19 different people have contributed code to this release which, to me, is an amazing figure for an OSS project that’s not only relatively young, but also built using .net, which is frequently “bashed” by certain people for its alleged lack of community and its apparent “do what MS says to do”, sheep like mentality.

So, what *is* in v0.8.0?

You can see the commits that went into v0.8.0 in the GitHub comparison, or take a look at the issue list for a list of features / bug fixes, but some of the highlights are:

  •  Static content conventions – now static content is supported out of the box with pluggable conventions for which files are server from where.
  • CSRF protection – currently only supported in Razor, Spark and SSVE, but it’s now possible to validate  “tokens” (with or without a timeout) to protect your site against CSRF vulnerabilities. There’s a sample of this in the main ASPNet demo project.
  • The view cache should now be disabled in debug mode properly (yay!)
  • A new exception handling pipeline and built in error pages.
  • Basic authentication (as a new Nuget)
  • Protocol Buffers de/serialization support (as a new Nuget)
  • An awesome new logo (see below)
Plus plenty of other bug fixes, tweaks and behind the scenes changes.

Logo and website

Thanks to the efforts of Nicolas Garfinkiel (codetothepeople.blogspot.com) Nancy now has an awesome new logo – many thanks to Nicolas for the speed he put this together, and for putting up with Andreas and myself nitpicking so much 😉 You can see the new logo in “action” in the updated favicon, and on our newly launched Nancy site – go check it out!

Please note that we did have a redirect on that site, so if you get redirected to github you might have to press ctrl+enter (seems to work in Chrome) or clear your cache or restart your browser or something .. sorry 🙂

Thanks

So, a big thank you to everyone who contributed to this release – comments/suggestions, bug reports, fixes, features and even just giving kudos on Twitter – it’s all very much appreciated.

Now.. onwards and upwards to v0.9.0!

P.S. Andreas and I have recently recorded a Herding Code episode – so keep an eye (or ear) out for that.