Click here to Skip to main content
11,929,924 members (53,466 online)
Click here to Skip to main content
Add your own
alternative version

Tagged as


178 bookmarked

Web.config File - ASP.NET

, 18 Dec 2011 CPOL
Rate this:
Please Sign up or sign in to vote.
Complete description about the ASP.NET configuration. This article helps you to understand the web.config file in a better way and also helps you to program against it.


The time you start developing your web application until you finish the application, you will more often use the Web.config file not only for securing your application but also for wide range of other purposes which it is intended for. ASP.NET Web.config file provides you a flexible way to handle all your requirements at the application level. Despite the simplicity provided by the .NET Framework to work with web.config, working with configuration files would definitely be a task until you understand it clearly. This could be one of the main reasons that I started writing this article.

This article would be a quick reference for the professional developers and for those who just started programming in .NET. This article would help them to understand the ASP.NET configuration in an efficient way. The readers may skip the reading section "Authentication, Authorization, Membership Provider, Role Provider and Profile Provider Settings", as most of them are familiar with those particular settings.


In this article, I am going to explain about the complete sections and settings available in the Web.config file and how you can configure them to use in the application. In the later section of the article, we will see the .NET classes that are used to work with the configuration files. The contents of the articles are summarized below:

  1. Web.config sections/settings
  2. Reading Web.config
  3. Writing or manipulating Web.config
  4. Encrypting the Web.config and
  5. Creating your own Custom Configuration Sections

Points to be Remembered

ASP.NET Web.config allows you to define or revise the configuration settings at the time of developing the application or at the time of deployment or even after deployment. The following are brief points that can be understood about the Web.config file:

  • Web.config files are stored in XML format which makes us easier to work with.
  • You can have any number of Web.config files for an application. Each Web.config applies settings to its own directory and all the child directories below it.
  • All the Web.config files inherit the root Web.config file available at the following location systemroot\Microsoft.NET\Framework\versionNumber\CONFIG\Web.config location
  • IIS is configured in such a way that it prevents the Web.config file access from the browser.
  • The changes in Web.config don’t require the reboot of the web server.

Web.config Settings

Before we start working with configuration settings of ASP.NET, we see the hierarchy of the Web.config file.







So from the above tree structure, we can understand that the configuration tag is the root element of the Web.config file under which it has all the remaining sub elements. Each element can have any number of attributes and child elements which specify the values or settings for the given particular section. To start with, we’ll see the working of some of the most general configuration settings in the Web.config file.


In the configuration hierarchy, the most common thing we will work with is the system.web section. Now we look at some of the child sections of the system.web section of Web.config file.

Compilation Settings

If you are using Visual Studio 2010, probably the only available section of Web.config file by default is Compilation section. If you want to specify the target framework or if you need to add an assembly from the Global Assembly Cache (GAC) or if you want to enable the debugging mode of the application, you can take Compilation settings as granted for these tasks. The following code is used to achieve the discussed settings:

                 debug="true" strict="true" explicit="true" batch="true"
                 optimizeCompilations="true" batchTimeout="900"
                 maxBatchSize="1000" maxBatchGeneratedFileSize="1000"
                 numRecompilesBeforeAppRestart="15" defaultLanguage="c#"
                 targetFramework="4.0" assemblyPostProcessorType="">
		<add assembly="System, Version=1.0.5000.0, Culture=neutral,


Under the assemblies element, you are supposed to mention the type, version, culture and public key token of the assembly. In order to get the public key token of an assembly, you need to follow the below mentioned steps:

  1. Go to Visual Studio tools in the start menu and open the Visual Studio command prompt.
  2. In the Visual Studio command prompt, change the directory to the location where the assembly or .dll file exists.
  3. Use the following command, sn –T itextsharp.dll.
  4. It generates the public key token of the assembly. You should keep one thing in mind that only public key token is generated only for the assemblies which are strongly signed.


C:\WINNT\Microsoft.NET\Framework\v3.5> sn -T itextsharp.dll
Microsoft (R) .NET Framework Strong Name Utility Version 3.5.21022.8
Copyright (c) Microsoft Corporation.  All rights reserved.

Public key token is badfaf3274934e0

Explicit and sample attributes are applicable only to VB.NET and C# compiler however ignores these settings.

Page Settings

Ok, by this time, we have got familiar with the Web.config file and we have seen the settings of Compilation Sections, now we will see the settings of a page. As an ASP.NET application consists of several number of pages, we can set the general settings of a page like sessionstate, viewstate, buffer, etc., as shown below:

<pages buffer ="true" styleSheetTheme="" theme ="Acqua"
              masterPageFile ="MasterPage.master"

By using the MasterPageFile and theme attributes, we can specify the master page and theme for the pages in web application.

Custom Error Settings

The next section of Web.config file, we are going to look around is Custom Error settings, by the name itself it is clear that we can configure the settings for the application level errors in these section. Now we will see the description of the customErrors section of the Web.config from the below mentioned code snippet.

<customErrors defaultRedirect ="Error.aspx" mode ="Off">
   <error statusCode ="401" redirect ="Unauthorized.aspx"/>

The customErrors section consists of defaultRedirect and mode attributes which specify the default redirect page and the on/off mode respectively.
The subsection of customErrors section allows redirecting to specified page depending on the error status code.

  • 400 Bad Request
  • 401 Unauthorized
  • 404 Not Found
  • 408 Request Timeout

For a more detailed report of status code list, you can refer to this URL:

Location Settings

If you are working with a major project, probably you might have numerous numbers of folders and sub-folders, at this kind of particular situation, you can have two options to work with. First thing is to have a Web.config file for each and every folder(s) and Sub-folder(s) and the second one is to have a single Web.config for your entire application. If you use the first approach, then you might be in a smoother way, but what if you have a single Web.config and you need to configure the sub-folder or other folder of your application, the right solution is to use the "Location" tag of "system.web" section of Web.config file. However you can use this tag in either of the discussed methods.

The following code shows you to work with Location settings:

<location path="Login.aspx">
	         <allow users="*"/>
<location path ="Uploads">
	<compilation debug = "false">

In a similar way, you can configure any kind of available settings for any file/folder using the location tag.

Session State and View State Settings

As we all know, the ASP.NET is stateless and to maintain the state we need to use the available state management techniques of ASP.NET. View state and session state are among them. For complete information about view state and Session State and how to work with, there are some excellent articles in CodeProject, which you can refer here:

Now we'll see the Web.config settings of View State and Session State:
View State can be enabled or disabled by using the following page settings in the web.config file.

<Pages EnableViewState="false" />

Session state settings for different modes are as shown below:

<sessionState mode="InProc" />
<sessionState mode="StateServer"
stateConnectionString= "tcpip=Yourservername:42424" />
<sessionState mode="SQLServer" sqlConnectionString="cnn" />

HttpHandler Settings

HttpHandler is a code that executes when an http request for a specific resource is made to the server. For example, request an .aspx page the ASP.NET page handler is executed, similarly if an .asmx file is requested, the ASP.NET service handler is executed. An HTTP Handler is a component that handles the ASP.NET requests at a lower level than ASP.NET is capable of handling.

You can create your own custom http handler, register it with IIS and receive notice whenever a request is made. For doing this, you just need to create a class which implements IHttpHanlder and then you need to add the following section of configuration settings in the web.config file. For this demonstration, I have created a sample imagehandler class which displays a JPG image to the browser.You can go through the imagehandler class code in the sample download code.

    <add verb="*" path="*.jpg" type="ImageHandler"/>
    <add verb="*" path="*.gif" type="ImageHandler"/>

HttpModule Settings

HttpModule is a class or an assembly that implements the IHttpModule interface that handles the application events or user events. You can too create your own custom HttpModule by implementing the interface and configure it with ISS. The following settings show the HttpModules configuration in the web.config.

      <add type ="TwCustomHandler.ImageHandler"
           name ="TwCustomHandler"/>
      <remove name ="TwCustomHandler"/>
      <clear />

Authentication, Authorization, Membership Provider, Role Provider and Profile Provider Settings

These settings are directly available in the web.config file if you have created the ASP.NET application by using the Visual Studio 2010. I'm not going to elaborate them as there are lot of articles in CodeProject describing the functionality and use of these settings and for further information you can refer to them. Some of the links are here:

Authentication Settings

<authentication mode="Forms">
     <forms cookieless="UseCookies" defaultUrl="HomePage.aspx"
                    loginUrl="UnAuthorized.aspx" protection="All" timeout="30">

Authorization Settings

        <allow roles ="Admin"/>
        <deny users ="*"/>

Membership Provider Settings

<membership defaultProvider="Demo_MemberShipProvider">
	   <add name="Demo_MemberShipProvider"
	       passwordAttemptWindow="10" passwordStrengthRegularExpression="">

Role Provider Settings

<roleManager enabled="true" cacheRolesInCookie="true"
cookieName="TBHROLES" defaultProvider="Demo_RoleProvider">
                  <add connectionStringName="dld_connectionstring"
                  applicationName="/" name="Demo_RoleProvider"
                  type="System.Web.Security.SqlRoleProvider, System.Web,
                  Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>

Profile Provider Settings

<profile defaultProvider="Demo_ProfileProvider">
	<add name="Demo_ProfileProvider" connectionStringName="cnn"
	applicationName="/" type="System.Web.Profile.SqlProfileProvider,
	System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
	<add name="Name" type="String"/>
	<add name="DateofBirth" type="DateTime"/>
	<add name="Place" type="string"/>


In the above section, we have seen the settings available in system.web tag, now we will see the available settings in appSettings section.
appSettings element helps us to store the application settings information like connection strings, file paths, URLs, port numbers, custom key value pairs, etc.
The following code snippet shows the example of appSettings Section:

	<add key="AppKey" value="APLJI12345AFAFAF89999BDFG"/>


The most common section of web.config file the connectionStrings sections allows you to store multiple connection strings that are used in the application. The connectionStrings tag consists of child element with attributes name and connectionstring which is used to identify the connectionstring and the other is used to connect to the database server respectively.

The general connectionstring settings are shown below:

    <add name ="cnn" connectionString ="Initial Catalog = master; 
		Data Source =localhost; Integrated Security = true"/>


ConfigSections helps you to create your own custom configuration section that can be used with the web.config file. We look at this in the later section of the article, for the time being, we can have look at the configsection settings. ConfigSections should be declared just below the configuration (parent element) otherwise it is going through you an error.

    <sectionGroup name="pageAppearanceGroup">

Programmatically Accessing the Web.config File

We can use the C# classes to read and write the values to the Web.config file.

Reading appSettings values

The following code is used to read the appSettings values from Web.config file. You can use either of the methods shown below:

//Method 1:
        string key = ConfigurationManager.AppSettings["AppKey"];

//Method 2:
        Configuration config = WebConfigurationManager.OpenWebConfiguration("~/");
        KeyValueConfigurationElement Appsetting = config.AppSettings.Settings["AppKey"];
        Response.Write(Appsetting.Key + " <br/>" + "Value:" + Appsetting.Value);

Reading connectionstring values

The following code is used to read the connectionstring values from Web.config file. You can use either of the methods shown below:

//Method 1:
        string cnn = ConfigurationManager.ConnectionStrings["conn"].ConnectionString;

//Methods 2:
        Configuration config = WebConfigurationManager.OpenWebConfiguration("~/");
        ConnectionStringSettings cnnstring;

        if (config.ConnectionStrings.ConnectionStrings.Count > 0)
            cnnstring = config.ConnectionStrings.ConnectionStrings["conn"];
            if (cnnstring != null)
                Response.Write("ConnectionString:" + cnnstring.ConnectionString);
                Response.Write(" No connection string");

Reading configuration section values

The following code is used to read the configuration section values from Web.config file. The comments in the code will help you to understand the code:

// Intialize System.Configuration object.
Configuration config = WebConfigurationManager.OpenWebConfiguration("~/");
//Get the required section of the web.config file by using configuration object.
CompilationSection compilation = 
//Access the properties of the web.config

Update the configuration section values

The following code is used to read the configuration section values from Web.config file:

Configuration config = WebConfigurationManager.OpenWebConfiguration("~/");
//Get the required section of the web.config file by using configuration object.
CompilationSection compilation = 
//Update the new values.
compilation.Debug = true;
//save the changes by using Save() method of configuration object.
if (!compilation.SectionInformation.IsLocked)
    Response.Write("New Compilation Debug"+compilation.Debug);
    Response.Write("Could not save configuration.");

Encrypt Configuration Sections of Web.config File

As we have already discussed that IIS is configured in such a way that it does not serve the Web.Config to browser, but even in some such situation to provide more security, you can encrypt some of the sections of web.config file. The following code shows you the way to encrypt the sections of web.config file:

Configuration config = WebConfigurationManager.OpenWebConfiguration
ConfigurationSection appSettings = config.GetSection("appSettings");
if (appSettings.SectionInformation.IsProtected)

Custom Configuration Section in Web.config

I have thought twice before I could put this section of content in this article, as there are a lot of wonderful articles explaining this topic, but just to make this article as complete, I have included this topic too.

Create Custom Configuration Section

The ConfigurationSection class helps us to extend the Web.config file in order to fulfill our requirements. In order to have a custom configuration section, we need to follow the below steps:

Before we actually start working with it, we will have a look at the section settings. We need to have a ProductSection element with child elements girdSettings and color. For this purpose, we will create two classes with the child elements which inherits ConfigurationElement as shown below:

public class GridElement : ConfigurationElement
    [ConfigurationProperty("title", DefaultValue = "Arial", IsRequired = true)]
    [StringValidator(InvalidCharacters = "~!@#$%^&*()[]{}/;'\"|\\", 
			MinLength = 1, MaxLength = 60)]
    public String Title
            return (String)this["title"];
            this["title"] = value;

    [ConfigurationProperty("count", DefaultValue = "10", IsRequired = false)]
    [IntegerValidator(ExcludeRange = false, MaxValue = 30, MinValue = 5)]
    public int Count
        { return (int)this["count"]; }
        { this["size"] = value; }

public class ColorElement : ConfigurationElement
    [ConfigurationProperty("background", DefaultValue = "FFFFFF", IsRequired = true)]
    [StringValidator(InvalidCharacters = "~!@#$%^&*()[]{}/;
		'\"|\\GHIJKLMNOPQRSTUVWXYZ", MinLength = 6, MaxLength = 6)]
    public String Background
            return (String)this["background"];
            this["background"] = value;

    [ConfigurationProperty("foreground", DefaultValue = "000000", IsRequired = true)]
    [StringValidator(InvalidCharacters = "~!@#$%^&*()[]{}/;
		'\"|\\GHIJKLMNOPQRSTUVWXYZ", MinLength = 6, MaxLength = 6)]
    public String Foreground
            return (String)this["foreground"];
            this["foreground"] = value;


... and then we will create a class called ProductSection, for the root element which includes the above child elements.

public class ProductSection : ConfigurationSection
    public GridElement gridSettings
            return (GridElement)this["gridSettings"];
        { this["gridSettings"] = value; }

    // Create a "color element."
    public ColorElement Color
            return (ColorElement)this["color"];
        { this["color"] = value; }

Then finally, we will configure these elements in Web.config file as shown below:

     <section name ="ProductSection" type ="<ProductSection"/>

   <gridSettings title ="Latest Products" count ="20"></gridSettings>
   <color background="FFFFCC" foreground="FFFFFF"></color>
Access Custom Configuration Section

The following code is used to access the custom configuration section:

ProductSection config = (ProductSection)ConfigurationManager.GetSection("ProductSection");
string color =config.Color.Background;
string title =config.gridSettings.Title;
int count = config.gridSettings.Count;


In this article, we have learned about the ASP.NET configuration file and we have seen almost all the available and frequently used settings of web.config file. I hope you enjoyed reading this article and this article might have helped you in completing your tasks in some way. Any comments, suggestions and feedback are always welcome, which will help me to write more articles and improve the way in which I present the articles.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

S V Saichandra
Software Developer Emirates Group IT
United Arab Emirates United Arab Emirates
S V Sai Chandra is a Software Engineer from Hyderabad Deccan. He started Embedded Programing in his college days and now he is a Web Developer by Profession. He Loves coding and his passion has always been towards Microsoft Technologies. Apart from coding his other hobbies include reading books, painting and hang out with friends is his most favorite past time hobby.
He blogs at
Technical Skills:
C#,Ado.Net,Asp.Net,Sql Server,JavaScript,XML,Web services.

You may also be interested in...

Comments and Discussions

QuestionThe only problem Pin
Kumarbs23-Sep-15 19:54
professionalKumarbs23-Sep-15 19:54 
QuestionConfigurationErrorsException was unhandled , unable to save web.config Pin
Member 119476041-Sep-15 9:15
memberMember 119476041-Sep-15 9:15 
QuestionSuggestion Pin
Farhad Dawar10-Mar-15 1:00
memberFarhad Dawar10-Mar-15 1:00 
QuestionComments Pin
Farhad Dawar10-Mar-15 0:55
memberFarhad Dawar10-Mar-15 0:55 
QuestionQuestion on session modes Pin
Member 114945863-Mar-15 2:23
memberMember 114945863-Mar-15 2:23 
Questionediting web.config system.servicemodel Pin
blpandya9-Oct-14 21:21
memberblpandya9-Oct-14 21:21 
GeneralMy vote of 5 Pin
Sibeesh KV8-Oct-14 0:31
professionalSibeesh KV8-Oct-14 0:31 
GeneralMy vote of 3 Pin
Krismaly17-Apr-14 10:47
memberKrismaly17-Apr-14 10:47 
GeneralMy vote of 5 Pin
aditya_bokade1-Dec-13 1:37
memberaditya_bokade1-Dec-13 1:37 
QuestionThanks Pin
Amir Mehrabi-Jorshari28-Oct-13 21:09
memberAmir Mehrabi-Jorshari28-Oct-13 21:09 
Questiongood articel Pin
Vivek Doddaguni14-Oct-13 14:27
memberVivek Doddaguni14-Oct-13 14:27 
QuestionLocation Tag Pin
VICK9-Oct-13 20:58
member VICK9-Oct-13 20:58 
QuestionMy Vote Of Five Pin
Pratik Bhuva12-Sep-13 21:57
memberPratik Bhuva12-Sep-13 21:57 
QuestionMy Vote Of 5 Pin
haivanguyen21-Jul-13 19:53
memberhaivanguyen21-Jul-13 19:53 
GeneralMy vote of 5 Pin
Аslam Iqbal15-May-13 2:01
memberАslam Iqbal15-May-13 2:01 
GeneralMy vote of 5 Pin
Carsten V2.024-Apr-13 6:17
memberCarsten V2.024-Apr-13 6:17 
GeneralMy vote of 5 Pin
VikZ919-Apr-13 3:36
memberVikZ919-Apr-13 3:36 
GeneralMy vote of 5 Pin
DalbirS8-Apr-13 0:11
memberDalbirS8-Apr-13 0:11 
GeneralMy vote of 4 Pin
Subbu Kakarla27-Feb-13 21:38
memberSubbu Kakarla27-Feb-13 21:38 
QuestionWeb.config Pin
Member 987096327-Feb-13 19:47
memberMember 987096327-Feb-13 19:47 
GeneralMy vote of 3 Pin
Salman M Sayed15-Jan-13 0:04
memberSalman M Sayed15-Jan-13 0:04 
GeneralMy vote of 5 Pin
hemantrautela5-Jan-13 20:25
memberhemantrautela5-Jan-13 20:25 
GeneralMy vote of 5 Pin
sarathkumarnallathambi17-Dec-12 21:04
membersarathkumarnallathambi17-Dec-12 21:04 
QuestionVery Good Article (5)! It answered many of my questions. Thanks Mr. Chandra Pin
Jack.LaPenta26-Dec-12 7:39
memberJack.LaPenta26-Dec-12 7:39 
GeneralMy vote of 3 Pin
rajnish2patel30-Nov-12 9:38
memberrajnish2patel30-Nov-12 9:38 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web03 | 2.8.151126.1 | Last Updated 18 Dec 2011
Article Copyright 2011 by S V Saichandra
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid