ELMAH: ASP.NET security

Question

Hey all!

I have an ASP.NET 3.5 application which is using the Visual Studio Development Server. I set ELMAH up, and it is working fine. I set up the AXD "file" and XML files (using XML as the storage medium) to be in a folder under the root:

v3/elmah/

Now, I'd like to have it so that when elmah or elmah/elmah.axd (or anything in this directory) is requested, that a username/password dialog is presented. Right now, I have this in the web.config:

Which is allowing all authenticated users, I believe. I've tried to disable anonymous access to that directory, but the file is still being served. Is there something I need to change in the Security of the file system?

BTW, this is XP SP3.

Thanks all!

Answer 1

Did you add something like this to your web.config?

<location path="admin/elmah.axd">
    <system.web>
      <authorization>
        <allow roles="Admin"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

There is also a requirePermission attribute available for the ELMAH section nodes in the web.config.

<sectionGroup name="elmah">
  <section name="security" requirePermission="true" type="Elmah.SecuritySectionHandler, Elmah" />
  <section name="errorLog" requirePermission="true" type="Elmah.ErrorLogSectionHandler, Elmah" />
  <section name="errorMail" requirePermission="true" type="Elmah.ErrorMailSectionHandler, Elmah" />
  <section name="errorFilter" requirePermission="true" type="Elmah.ErrorFilterSectionHandler, Elmah" />
</sectionGroup>

Update to avoid a mess in the comments:

In my web.config I use something like:

<authentication mode="Forms">
    <forms loginUrl="Users/SignIn" 
           timeout="30"
           .. moreStuffHere />
</authentication>