WebAPI Help Pages: disable for Production release

Question

I have developed a number of internal REST interfaces using the older WCF framework in VS 2010. The ability for it to generate help pages was handy for DEV and QA platforms, but for a production release it was easy to disable the generation of these help pages in the web.config file:

<standardEndpoint name="" helpEnabled="false" automaticFormatSelectionEnabled="true"/>

I am now moving on to use the WebAPI framework instead (currently version 1 on VS 2012), but it doesn't appear to be as trivial to turn this feature off (i.e. I can't find any information on how to do this in a web.config file).

Certainly I can go ahead and do this by hand within the code itself, but surely there's an easier way; something akin to how WCF did it as described above. I'd like to use the web.config file approach since I already have the web.release.config transform files in place for other settings.

Any thoughts on best practices on this would be appreciated.

Beggary

Answer 1

Web API doesn't have an out of box support with respect to web.config based enabling or disabling of helppage.

Some options you can consider:

• Since HelpPage is installed as an MVC area, when deploying to production you could just exclude this HelpPage folder.

• Create an action filter which returns 404 as suggested here: Conditionally disable ASP.NET MVC Controller

NOTE: for the above cases, if you are using the default Web API template, then yeah you would need additional step of display/not display the Help link from the navigation bar.

Cavalierly

Yes, that's what it seems to be. In this case I am using the default template, but I don't think it'll be much work to get around this. I can certainly put an indicator in the web.config file for my own use within the code, or perhaps adding a RELEASE preprocessor directive and use good ol' #if #endif to block code out... – Beggary

I just deleted the areas folder. Swagger API is much nicer than the default one anyway. – Dvorak

Answer 2

Open the Global.asax.cs,modify your code like the following snippet code:

#if DEBUG
   AreaRegistration.RegisterAllAreas();
#endif

Because the help page is in the Area named 'HelpPage',so we can ignore it by the above code in the release or production environment.

Boozy

This in itself is not a secure solution.If you enter the url in the browser you get an unhandled exception complete with stack trace and version information for both the .NET Framework and ASP.NET – Nomo

@Nomo That's only true if you are hitting the web API site from the server itself. If you hit it remotely it just says "An error occurred while processing your request" – Python

Answer 3

You can use directive #if DEBUG to hide your code in realase

Karlie

DEBUG flag is no use in most cases, because staging and\or test environment run without DEBUG. – Chromic

Answer 4

My solution for disabling ApiController controller:

• Uses WebConfig AppSettings config flag instead of (#if DEBUG)
• Before method is invoked ExecuteAsync intercepts the invocation and checks feature toggle (feature flag);
• if feature is disabled, returns HTTP 410 GONE
• If it's common for many controllers, move the code to controller's base class

The code:

public class TestController : ApiController
{
    public override Task<HttpResponseMessage> ExecuteAsync(HttpControllerContext controllerContext, CancellationToken cancellationToken)
    {
        var featureFlag = Convert.ToBoolean(System.Configuration.ConfigurationManager.AppSettings["EnableTest"]);

        if (featureFlag == false)
        {
            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.Gone));
        }

        return base.ExecuteAsync(controllerContext, cancellationToken);
    }

Chromic

Answer 5

Combining Farb's and Soeholm's answers you get the Help page won't display AND it throws a 404 instead of a 500.

In Global.asax.cs

#if DEBUG // Make help page unavailable on release builds
    AreaRegistration.RegisterAllAreas(); 
#endif

and then in WebApiConfig.Register

#if !DEBUG 
    config.Routes.IgnoreRoute("help", "help"); // Make help page, which is now unavailable on release builds, throw a 404 instead of a 500.
#endif

Only I didn't use DEBUG, I made it a setting and change it with an xml transform depending on where it's deployed.

Python

Answer 6

In case someone stumbles upon this question, here's how I managed to do it.

I added the following app setting to the base Web.config file:

<add key="ExcludeHelpPage" value="false" />

I then transformed this value in my LIVE or RELEASE config file, like this:

<add key="ExcludeHelpPage" value="true" xdt:Transform="Replace" xdt:Locator="Match(key)"  />

Then I added the following code to the end of my WebApiConfig.Register method:

if (Convert.ToBoolean(System.Configuration.ConfigurationManager.AppSettings["ExcludeHelpPage"]))
{
    config.Routes.IgnoreRoute("help", "help");
}

This will make the help page unavailable for configs with ExcludeHelpPage set to true.

Brough

Your idea seems really great but it's not working for me. On my Register I have this config.Routes.MapHttpRoute( name: "DefaultApi", routeTemplate: "api/{controller}/{id}", defaults: new { id = RouteParameter.Optional } );and I add your code after. But on the "HelpPageAreaRegistration.cs" I have new { controller = "Help", action = "Index", apiId = UrlParameter.Optional }); Any idea why the help is not being ignored? – Europa

This didn't work for me unless I combined it with Farb's answer (comment out RegisterAllAreas). – Python