GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — BoardConfiguration Settings

BoardConfiguration Settings

Ingo edited this page Nov 2, 2026 · 7 revisions

Board Configuration Settings

All settings of the BoardConfiguration section in the appsettings.json of YAF.NET v4.

When you run YAF.NET with Docker, every setting can also be set as an environment variable, e.g. BoardConfiguration__BoardID=1 (see Docker).

General

Setting	Type	Default	Description
`BoardID`	integer	`1`	The ID of the board shown by this application. You can create as many boards as you want (Host > Boards); each one works as a separate forum with its own users.
`CategoryID`	integer	`0`	If set, the main page shows only this category. `0` shows all categories.
`AllowLoginAndLogoff`	boolean	`true`	Turns the forum's own log in / log off on or off. Set it to `false` if the main application handles the log in.
`GDPRControllerAddress`	string	empty	The email address shown on the privacy page in the GDPR section.
`UrlRewritingMode`	string	empty	How special characters in URLs are handled: `Unicode` - replaces URL symbols with Unicode characters `Translit` - replaces Unicode characters with ASCII characters empty - replaces non-ASCII characters with dashes

Database

Setting	Type	Default	Description
`ConnectionProviderName`	string	empty	The database provider. Must match the data package you use: `Microsoft.Data.SqlClient` - SQL Server `MySql.Data.MySqlClient` - MySQL / MariaDB `Npgsql Data Provider` - PostgreSQL `System.Data.SQLite` - SQLite
`DatabaseObjectQualifier`	string	`yaf_`	The prefix of all YAF.NET tables. Only change it if you know what you are doing.
`DatabaseOwner`	string	`dbo`	The owner (schema) of the YAF.NET database objects. Only change it if you know what you are doing.
`SqlCommandTimeout`	integer	`99999`	The SQL command timeout in seconds. `0` means unlimited.

The connection string itself is set in ConnectionStrings:DefaultConnection.

Files and folders

Setting	Type	Default	Description
`StaticFilesRoot`	string	empty	Loads uploads and images from a sub folder of `wwwroot`, e.g. `wwwroot/[StaticFilesRoot]/uploads`. Needed when YAF.NET is integrated as an area, e.g. `Forums/`.
`MultiBoardFolders`	boolean	`false`	Uses a separate folder for each board for uploads and images, e.g. `wwwroot/1/uploads` for board `1` (combined with `StaticFilesRoot`: `wwwroot/[StaticFilesRoot]1/uploads`).
`Area`	string	empty	The name of the Razor Pages area when YAF.NET is embedded into another application, e.g. `Forums`. See Integration into an existing ASP.NET Core application.

Security

Setting	Type	Default	Description
`UseHttpsRedirection`	boolean	`true`	Redirects HTTP requests to HTTPS (HTTPS Redirection Middleware).
`UseRateLimiter`	boolean	`true`	Turns on the rate limiting middleware for all forum pages and API calls. Requests above the limit get the status `429 Too Many Requests`. Admins and users with at least the number of posts set in Host Settings > User Post Count to be ignored from Spam Check are not limited.
`RateLimiterPermitLimit`	integer	`10`	The maximum number of requests per IP address per minute when `UseRateLimiter` is on. Must be greater than `0`. The `appsettings.json` of the install package sets it to `100`; lower values can block normal users.
`TrustedProxies`	string array	empty	Reverse proxies or CDNs in a public network whose `X-Forwarded-For` / `X-Real-IP` headers are used as the client address, as addresses or networks in CIDR notation, e.g. `["203.0.113.5", "173.245.48.0/20"]`. Proxies in loopback and private networks (same host, LAN, Docker) are always trusted. If you run behind a public proxy or CDN (e.g. Cloudflare) and don't add it here, all users get the address of the proxy, which breaks IP banning, the spam checks and the rate limiter. See Reverse proxy and Cloudflare.
`XFrameOptions`	string	`SAMEORIGIN`	The `X-Frame-Options` header. It tells the browser whether your site may be shown in a frame, which protects against clickjacking.
`XContentTypeOptions`	string	`nosniff`	The `X-Content-Type-Options` header. It stops the browser from guessing (MIME-sniffing) the content type. `nosniff` is the only valid value.
`ReferrerPolicy`	string	`no-referrer`	The `Referrer-Policy` header. It controls how much information the browser sends to other sites when a user follows a link.
`ContentSecurityPolicy`	string	empty	The `Content-Security-Policy` header. It protects against XSS attacks by allowing content only from sources you list. Not sent when empty.

Legacy membership migration

These settings are only needed if you upgrade a forum from a version before 3.0, which still used the ASP.NET Membership provider. Without them, old passwords can't be verified and users can't log in. Skip them on a new installation.

Setting	Type	Default	Description
`LegacyMembershipHashAlgorithmType`	string	`MD5`	The hash algorithm of the old membership provider (`hashAlgorithmType`): `MD5`, `SHA1`, `SHA256`, `SHA384` or `SHA512`.
`LegacyMembershipHashCase`	string	`Upper`	The case of the old password hashes (`hashCase`): `Upper`, `Lower` or `None`.
`LegacyMembershipHashHex`	boolean	`false`	Whether the old password hashes are stored as hex (`hashHex`).

See Upgrade to YAF.NET v4 for how to take the values from an old web.config.

Example

"BoardConfiguration": {
  "GDPRControllerAddress": "",
  "BoardID": 1,
  "CategoryID": 0,
  "ConnectionProviderName": "Microsoft.Data.SqlClient",
  "DatabaseObjectQualifier": "yaf_",
  "DatabaseOwner": "dbo",
  "MultiBoardFolders": false,
  "AllowLoginAndLogoff": true,
  "SqlCommandTimeout": 99999,
  "URLRewritingMode": "Unicode",
  "UseHttpsRedirection": true,
  "UseRateLimiter": true,
  "RateLimiterPermitLimit": 100,
  "TrustedProxies": [],
  "XFrameOptions": "SAMEORIGIN",
  "XContentTypeOptions": "nosniff",
  "ReferrerPolicy": "no-referrer",
  "ContentSecurityPolicy": ""
}

YetAnotherForum.NET (YAF) the Open Source Discussion Forum for ASP.NET - https://YetAnotherForum.NET

YAF.NET Documentation

Getting started

Configuration

Administration

Help

Development

Legacy (v3 and older)

Clone this wiki locally

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.