Configuration

Damsy ERP behavior is controlled primarily through DamsyERP.UI/Web.config. This page explains the settings that affect local development, HTTPS, error handling, reporting, and upload limits.

Purpose

Know which keys to change when moving between development, staging, and production — and which defaults prevent common local-dev pitfalls.

When to adjust configuration

Scenario	Settings to review
First local run	Connection strings (separate page), ForceHttps, customErrors
Production IIS deploy	ForceHttps, customErrors, compilation debug, requireSSL
Large Excel imports	maxRequestLength, maxAllowedContentLength
Report viewer issues	Crystal appSettings, httpHandlers
JSON-heavy grids	aspnet:MaxJsonDeserializerMembers, maxJsonLength

Configuration file location

DamsyERP.UI/Web.config          ← active for local dev
DamsyERP.UI/Web.Release.config  ← transform applied on Release publish

Publish profiles apply Release transforms — verify production values on the server after deploy, not only in source control.

appSettings reference

Key	Typical dev value	Purpose
ForceHttps	false	When true, Global.asax permanently redirects HTTP → HTTPS
SecurityHeadersEnabled	true	Optional hardening response headers
ClientValidationEnabled	true	Unobtrusive client-side validation
UnobtrusiveJavaScriptEnabled	true	jQuery validation adapters
aspnet:MaxJsonDeserializerMembers	150000	Raises JSON deserializer member limit for large grids
EPPlus:ExcelPackage.LicenseContext	NonCommercial	EPPlus license context for imports
ExcelFilePath	Server path	Default path for sample Excel operations
CrystalImageCleaner-AutoStart	true	Crystal temp image cleanup
CrystalImageCleaner-Sleep	60000	Cleanup interval (ms)
CrystalImageCleaner-Age	120000	Max age before image cleanup (ms)
vs:EnableBrowserLink	false	Disables VS Browser Link websocket noise

ForceHttps

Read in Global.asax.cs during Application_BeginRequest:

var forceHttps = ConfigurationManager.AppSettings["ForceHttps"];
// When true → permanent redirect to HTTPS

danger

Setting ForceHttps=true without SSL on IIS Express or IIS causes redirect loops and apparent session/cookie loss. Enable only after TLS is installed and tested.

system.web settings

Compilation

<compilation targetFramework="4.5.2" debug="true" batch="true">

Set debug="false" in production for performance and security. Crystal Reports assemblies are explicitly referenced under <assemblies>.

customErrors

<customErrors mode="RemoteOnly" defaultRedirect="~/ManageError/Index">
  <error statusCode="404" redirect="~/ManageError/E404"/>
</customErrors>

Mode	Behavior
RemoteOnly	Detailed errors locally; friendly pages for remote clients
On	Always friendly pages — use in production
Off	Always detailed — never in production

Errors also flow through Application_Error in Global.asax.cs, which routes to ManageErrorController and file logging.

Session state

<sessionState mode="InProc" timeout="30" cookieless="false" regenerateExpiredSessionId="true"/>

Session is in-process — a worker process recycle clears all sessions. Scale-out across multiple IIS nodes requires changing to SQL Server or Redis session mode (not configured by default).

HTTP runtime and uploads

<httpRuntime targetFramework="4.5.2" maxRequestLength="102400" executionTimeout="7200" enableVersionHeader="false"/>

• maxRequestLength is in KB (102400 KB = 100 MB)
• executionTimeout is in seconds (7200 = 2 hours for long report/excel operations)

Cookies

<httpCookies httpOnlyCookies="true" requireSSL="false"/>

When deploying with HTTPS, set requireSSL="true" alongside ForceHttps=true.

system.webServer settings

Request filtering

<requestLimits maxAllowedContentLength="104857600"/>

maxAllowedContentLength is in bytes (104857600 = 100 MB). Must align with maxRequestLength for large uploads to succeed end-to-end.

Crystal image handler

Crystal Reports registers a dedicated handler for temporary chart/image resources. Both <httpHandlers> (legacy) and <system.webServer><handlers> (integrated mode) entries must remain intact.

How configuration loads at runtime

Developer notes

Authentication mode

<authentication mode="None"/>

Production login is custom session-based via LoginController and GetLoginUser — not ASP.NET Identity cookies.

Entity Framework section

EF6 is registered in configSections but is not the primary data path. Do not assume Code First migrations manage the ERP schema.

Environment-specific overrides

For production:

1. Publish with Release configuration
2. Set connection strings on the server (not in Git)
3. ForceHttps=true after SSL
4. customErrors mode="On"
5. compilation debug="false"

tip

Use IIS Configuration Editor or transform files to verify final merged Web.config on the server — transforms can surprise you if you only inspect source Web.config.

Common mistakes

Mistake	Symptom
ForceHttps=true on HTTP dev URL	Endless redirects, login never sticks
requireSSL=true without HTTPS	Session cookie not sent
Upload fails at 30 MB	maxRequestLength and maxAllowedContentLength mismatch
Removing Crystal handlers	Broken report images
customErrors Off in production	Stack traces exposed to users

Related pages

• Connection strings
• Requirements
• Running locally
• Technology stack

Next steps

Point the application at your database in Connection strings, then return to Running locally to verify login.