Security for ASP.NET Diagnostics page

Posted by Moe Sisko on Stack Overflow See other posts from Stack Overflow or by Moe Sisko
Published on 2010-05-06T00:42:02Z Indexed on 2010/05/06 0:48 UTC
Read the original article Hit count: 327

Filed under:

ASP.NET

|

diagnostics

|

security

I'm thinking of creating a diagnostics page for an ASP.NET app, which would be mostly intended for admin use to get more information about the application for diagnosing problems.

Examples of the info the page might have :

System.Environment.MachineName (might be useful in web farm scenarios)
System.Environment.Version
Environment.UserName
database name
current user's session ID

Some of the info on this page might be sensitive from a security perspective. If you've done this sort of page before, what sort of security did you put on access to this page ? .

© Stack Overflow or respective owner

Related posts about ASP.NET

Migrating ASP.NET MVC 1.0 applications to ASP.NET MVC 2 RTM

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Note: ASP.NET MVC 2 RTM isn’t yet released! But this tool will help you get your ASP.NET MVC 1.0 applications ready for when it is! I have updated the MVC App Converter to convert projects from ASP.NET MVC 1.0 to ASP.NET MVC 2 RTM. This should be last the last major change to the MVC App Converter… >>> More
April 14th Links: ASP.NET, ASP.NET MVC, ASP.NET Web API and Visual Studio

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Here is the latest in my link-listing blog series: ASP.NET Easily overlooked features in VS 11 Express for Web: Good post by Scott Hanselman that highlights a bunch of easily overlooked improvements that are coming to VS 11 (and specifically the free express editions) for web development: unit… >>> More
Use ASP.NET 4 Browser Definitions with ASP.NET 3.5

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
We updated the browser definitions files included with ASP.NET 4 to include information on recent browsers and devices such as Google Chrome and the iPhone. You can use these browser definition files with earlier versions of ASP.NET such as ASP.NET 3 Read More......(read more) >>> More
ASP.NET webforms + ASP.NET Ajax versus ASP.NET MVC and Ajax framework freedom

as seen on Stack Overflow - Search for 'Stack Overflow'
If given the choice, which path would you take? ASP.NET Webforms + ASP.NET AJAX or ASP.NET MVC + JavaScript Framework of your Choice Are there any limitations that ASP.NET Webforms / ASP.NET AJAX has vis-a-vis MVC? >>> More
ASP.NET MVC 2 Released

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
I’m happy to announce that the final release of ASP.NET MVC 2 is now available for VS 2008/Visual Web Developer 2008 Express with ASP.NET 3.5. You can download and install it from the following locations: Download ASP.NET MVC 2 using the Microsoft Web Platform Installer Download… >>> More

Related posts about diagnostics

Add Trace methods to System.Diagnostics.TraceListner

as seen on Stack Overflow - Search for 'Stack Overflow'
I wrote a Log class derived from System.Diagnostics.TraceListener like so public class Log : TraceListener This acts as a wrapper to Log4Net and allows people to use System.Diagnostics Tracing like so Trace.Listeners.Clear(); Trace.Listeners.Add(new Log("MyProgram")); Trace.TraceInformation("Program… >>> More
The Benefits of using Oracle Diagnostics for Oracle Applications

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Listen to Kurt Larsen, Vice President of Oracle Support provide an update on the cost savings and problem avoidance provided to customers using Oracle Diagnostics within the E-Business Suite! >>> More
EBS: How To Install Oracle Diagnostics

as seen on Oracle Blogs - Search for 'Oracle Blogs'
Oracle Diagnostics Support Pack is available as a patch and can be applied using adpatch. Installation is easy. Just follow the steps in Doc ID 167000.1, eBusiness Suite Support - Oracle Diagnostics Support Pack Installation Guide For information on how to run the Diagnostics from a menu within… >>> More
Hello it’s your server calling

as seen on SQL Blogcasts - Search for 'SQL Blogcasts'
This is nothing exciting but I've always found this startup procedure very useful. All this simple procedure does is send you an email if the SQL Service Starts. If your Server is a cluster it will tell you which node you're on. -- On it's own this procedure can't actually be… >>> More
Cursors 1 Sets 0

as seen on SQL Blogcasts - Search for 'SQL Blogcasts'
I had an interesting experience with a database I essentially know nothing about. On the server is a database which stores session state, Microsoft provide the code/database with their dot net, so I'm told. Anyway this database has sat happily on the production server for the past 4 years I guess… >>> More