CODEWITHSUNDEEP
asp.netsecurityrsselmah
danludwig
danludwig

Reputation: 47365

Securing Elmah RSS Feeds in ASP.NET website

I followed the answer to this question Securing Elmah in ASP.NET website to restrict access to the elmah handler. However, it seems that adding an RSS feed to Outlook for the URL elmah.axd/rss or elmah.axd/digestrss bypasses the authentication. What's the point of securing the handler if someone can guess the RSS URL and subscribe to a feed of the error log?

Upvotes: 9

Views: 1393

Answers (1)

rick schott
rick schott

Reputation: 21137

I secure mine in the web.config with a role:

<location path="elmah.axd">
    <system.web>
        <authorization>
            <allow roles="SUPER_DUPER_ADMIN"/> 
            <deny users="*"/> 
        </authorization>
    </system.web>
</location>

Upvotes: 8

Related Questions