Write access to web.config

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Asim - 23 Dec 2004 20:33 GMT

What are the security risks to grant ASP.NET user write access to web.config?
I am working on a project in which I am required to update web.config at the
runtime, basically modifying access to different directories.

Any suggestion will be greatly appreciated.

Thanks

Reply to this Message

Ken Cox [Microsoft MVP] - 25 Dec 2004 01:40 GMT

Hi Asim,

There are certainly serious security risks in doing this. You might want to
consider storing the configuration information in some other place like a
database rather than the web.config.

I'd also worry about performance problems because whenever you change the
web.config, the Web application resets and will want to recompile.

Ken

> What are the security risks to grant ASP.NET user write access to
> web.config?
[quoted text clipped - 5 lines]
>
> Thanks

Reply to this Message

Patrick Olurotimi Ige - 28 Dec 2004 23:30 GMT

Asim..
I don't advice updating or modifying web.config files at anytime UNLESS
u need to do so..
GDLUCK
Patrick

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...