Media with aspx extension is not working

Question

We have migrated to Sitecore 10.1 from Sitecore 8.7.

In Sitecore 8, For-example, if the image location is /-/media/Project/Os-Theme/Styles/images/logo

Then the following url returns the same image

<site-url>/-/media/Project/Os-Theme/Styles/images/logo
<site-url>/-/media/Project/Os-Theme/Styles/images/logo.ashx
<site-url>/-/media/Project/Os-Theme/Styles/images/logo.jpg
<site-url>/-/media/Project/Os-Theme/Styles/images/logo.aspx.

I noticed that media item with .aspx is showing 404 error (The resource cannot be found) in Sitecore 10. Other extensions like ashx,jpg,png shows the correct media item.

The following url shows the correct image in Sitecore 10

<site-url>/-/media/Project/Os-Theme/Styles/images/logo
<site-url>/-/media/Project/Os-Theme/Styles/images/logo.ashx
<site-url>/-/media/Project/Os-Theme/Styles/images/logo.jpg

The aspx link doesn't work and shows 404 error.

<site-url>/-/media/Project/Os-Theme/Styles/images/logo.aspx.

Is there any setting to use aspx in the media item in Sitecore 10?

Any suggestion would be appreciated.

Thanks

Answer 1

Sitecore 10 doesn't support this. We had one asp.net application and one HTML site hosted as an Application within the Sitecore site. And in 9.1 these two applications were working fine with IgnoreUrlPrefixes settings. But after Sitecore 10 upgrade we found HTML application is working fine (we need to change the application to a Virtual directory) but asp.net application stops working. We had a discussion with Sitecore support also but no luck. So if you have a media extension with aspx, it is possible that Sitecore will not support that anymore.

Answer 2

It's not possible.

aspx extension is reserved for a particular type of files on IIS - they are handled with w3wp process:

• first translated into c# code,
• then csc.exe builds C# sourcode,
• and eventually Page.OnLoad is being executed.

If it was allowed to return the content of an aspx file, that would be a huge security risk.

You can read more about aspx files handling e.g. here:

https://blog.viettelcybersecurity.com/deep-understand-aspx-file-handling-and-some-related-attack-vector/

You can try using Media.RequestExtension setting:

<setting name="Media.RequestExtension" value="aspx" />

but that's not recommended for sure.

Answer 3

You can try using <setting name="Media.RequestExtension" value="" /> in that case it will work for all extensions, but as said above that's not recommended for sure, especially for .aspx extension