404 best practice

[Dunc]

I have a website where I wish to display a custom 404 error page when
applicable. I also want to ensure that when a search engine hits a
page that no longer exists, it gets a StatusCode of 404 so it will
eventually remove it from it's index.

Currently to do this, I'm capturing all errors using the
global.asax.cs -> Application_Error proc, setting the approriate
status code and redirecting:

if (CheckForErrorType(exc, "System.Web.HttpException") &&
exc.Message.ToString().IndexOf("does not exist") > 0)
{
Response.StatusCode = 404;
Response.Redirect("/pagenotfound.aspx", true);
}

When I load Fidder, it tells me that the missing page *is* being
loaded, returning a status code of 302 (object moved) then my friendly
error page is being loaded with the appropriate 404 code which is
useless.

My 404 page inherits from a Master Page, which checks for a Session so
I can't use a Server.Transfer as I get the error:

An exception of type 'System.Web.HttpException' occurred in
System.Web.dll but was not handled in user code

Additional information: Session state can only be used when
enableSessionState is set to true, either in a configuration file or
in the Page directive. Please also make sure that
System.Web.SessionStateModule or a custom session state module is
included in the <configuration>\<system.web>\<httpModules> section in
the application configuration.

Alternatively, I've tried using the CustomErrors tag in web.config:
<customErrors mode="RemoteOnly">
<error statusCode="404" redirect="/pagenotfound.aspx"/>
</customErrors>

Again, using Fiddler, it returns first the 302 status then the 404.

Has anyone else come across this issue and found a decent solution?

TIA

 

[Aidy]

You're getting 302 due to the Redirect. Can't you set up a custom 404 page
via IIS admin rather than handling it in your code? That should preserve
the 404 status.

 

[bruce barker]

a redirect is a 302. you should do a server transfer rather than a
client redirect.

-- bruce (sqlwork.com)

 

[Dunc]

Thanks, Bruce. Unfortunately, the 404 page derives from a master
page, which checks session. After some research, it seems the
Application_Error no longer holds a reference to the current
HttpContext, so redirecting from that causes the 404 page to create
that obscure error about not having session enabled.

D