# Application Settings

Files at the root of the Exago host install path (`appSettings.config` and `web.config`), Web Service path (`appSettings.config`), and scheduler install paths (`eWebReportsScheduler.exe.config`) allow for some additional options to be set. These are xml files which host config options which need to be loaded by the web server at runtime.

To apply a setting, add an xml key in the `<appSettings />` node with "key" and "value" parameter pairs, in the following form:

    <add key="key" value="value" />

The following article is a collection of all the possible app settings, and descriptions for their use. In general, you should not use any of these settings unless you have been specifically directed by an Exago Inc. staff member. Keys and values are case sensitive.

# Web App web.config

`web.config`

## sessionState

### cookieless

(v2018.1+) Enable or disable Cookieless Sessions. Possible values: True, False

### timeout & mode

Editing these attributes is not supported.

# Web App appSettings.config

`appSettings.config`

## sessionStorage

Determine which method to use to store session information for the user's configuration. See Using "In-Memory" Session Storage for details.

Possible values:

- Diff (default) - Store the "diff" between the user's config and the base config.
- InMemory - Store the entire effective config in session.

## inputSanitizationMethod

Determine how aggressively to sanitize user-input data, such as report name, description, etc., against script attacks.

Possible values:

- Safe (default) - Sanitizes against a blacklist of html tags and attributes. Less likely to alter user input.
- Aggressive - Sanitizes against a whitelist of html tags. Potentially more harmful to user input.
  (v2016.3.7+) Whitelist located at `{webAppInstallDir}\Config\Other\tagwhitelist.json`

## ExagoConfigPath

Specifies the location of the WebReports.xml config file when storing the config in a Cloud (Azure/Amazon) location. See Installing Exago on Azure for details.

## ShowErrorDetail

Set to false to disable the ability to append `?ShowErrorDetail=true` to an Exago URL to see the full text of error messages. See See Full Error Details for details.

Possible values:

- false - Show the generic error text. Overrides the URL flag.

## enableantiforgery

(v2016.2.12+) Enable protection for Cross-Site Request Forgery (CSRF) attacks.

Possible values:

- True - Enable anti-forgery protection.

## MinCompactionInterval

(v2016.2.12+) At specified intervals, during .NET Garbage Collection, Exago will attempt to compact the large object heap in order to reduce memory consumption by eliminating fragmentation. This will only happen in a .NET 4.5.1+ environment.

Possible values:

- 0 and up (default 3) - Specify the minimum number of minutes between compactions.
- -1 - Disable compaction.

## Security Protocol

(v2016.3.4+) Specify which security protocol(s) the application should use. Multiple values are separated by commas (,).

Possible values (one or more):

- Ssl3 - SSL 3.0
- Tls - TLS 1.0
- Tls11 - TLS 1.1
- Tls12 - TLS 1.2
- Tls13 - TLS 1.3 (.NET v4.6+)

## Monitoring.*

(v2017.1+) Encompasses several keys determining which monitoring data is collected by the application. See Configuring Monitoring for details.

## useSecurityToken

(v2018.1+) Enable two-factor authentication for Cookieless Sessions (the web server must enforce a secured connection).

Possible values:

- True - Enable security token.

# Scheduler Apps

`eWebReportsScheduler.exe.config`

## configFile

Specify the path & filename for the scheduler config file. Typically used in a multi-scheduler configuration where it would be desirable to maintain a global config file for all of them. If not specified, the scheduler will look for the config file in the default location.

## MinCompactionInterval

(v2016.2.12+) At specified intervals, during .NET Garbage Collection, Exago will attempt to compact the large object heap in order to reduce memory consumption by eliminating fragmentation. This will only happen in a .NET 4.5.1+ environment.

Possible values:

- 0 and up (default 3) - Specify the minimum number of minutes between compactions.
- -1 - Disable compaction.

## Monitoring.CollectExecuteReportUsage

(v2017.1+) Specify whether to collect data about the report executions handled by this scheduler.

Possible values:

- True - Enable collecting report execution data.

## inputSanitizationMethod

Determine how aggressively to sanitize user-input data, such as report name, description, etc., against script attacks.

Possible values:

- Safe (default) - Sanitizes against a blacklist of html tags and attributes. Less likely to alter user input.
- Aggressive - Sanitizes against a whitelist of html tags. Potentially more harmful to user input.
  (v2016.3.7+) Whitelist located at `{schedulerInstallDir}\tagwhitelist.json`

# Web Service App

`appSettings.config`

## ExagoRest

Add this key to enable use of the REST Web Service API.

Possible values:

- True - Enable the REST Web Service API.

## Security Protocol

(v2016.3.4+) Specify which security protocol(s) the application should use. Multiple values are separated by commas (,).

Possible values (one or more):

- Ssl3 - SSL 3.0
- Tls - TLS 1.0
- Tls11 - TLS 1.1
- Tls12 - TLS 1.2
- Tls13 - TLS 1.3 (.NET v4.6+)