Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP .Net Security > Write access to web.config

Reply
Thread Tools

Write access to web.config

 
 
Dominick Baier
Guest
Posts: n/a
 
      12-24-2004
in short : don't do it

or..

it is not a good choice to modify web.config because

- your opening up to all kind of other security issues if your worker process has write access to web.config (thats a defense in depth measure) - then you have to be VERY shure that the rest of your app is based on rock-solid code

- your asp.net app will restart everytime you modify web.config

if you really want to modify web.config - refactor out that code - package it in a serviced component (com+) and give this component a seperate identity which is allowed to modify web.config -

but my suggestion would be :

there is an event in the http pipeline of asp.net that's specifically made for this purpose - AuthorizeRequest - there you can plug in your code to programmatically decide who is authorized or not (from an alternate data store like an xml file or db)

don't mess with web.config (and its dacls) !



---
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

nntp://news.microsoft.com/microsoft.public.dotnet.framework.aspnet.security/<(E-Mail Removed)>

What are the security risks to grant ASP.NET user write access to web.config?
I am working on a project in which I am required to update web.config at the
runtime, basically modifying access to different directories.

Any suggestion will be greatly appreciated.

Thanks

[microsoft.public.dotnet.framework.aspnet.security]
 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
write Unicode to sys.out.write without access to sitecustomize.py Rob Knop Python 1 08-28-2009 03:22 PM
How to use Response.write to write to a specific area on a aspx pa =?Utf-8?B?QWJlbCBDaGFu?= ASP .Net 6 05-03-2006 10:16 PM
DVD Write speed - Not able to write at 8 speed Vincent Wonnacott Computer Support 1 09-16-2004 03:14 PM
How to open a new console and write something out write printf() Peter Hansen C++ 1 08-24-2003 11:49 AM
Write Access to Access DataBase Microsoft ASP .Net Security 0 08-14-2003 07:56 PM



Advertisments