Secure elmah with ASp.NET security but only to some users

Question

HI, I am developing a ASP.NET App and I want to add elmah. The problem I have is the the users login to the site and the only way I found to secure elmah is to authenticate users, not a specific user.

I am using ASP.NET MVC 2 and NET 4.

Any Ideas?

Answer 1

You'll want to restrict the elmah.axd (assuming you're using the handler) to a specific user role. Not just all authenticated users.

<!-- Deny unauthenticated users to see the elmah.axd -->
<location path="admin/elmah.axd">
  <system.web>
    <authorization>
      <deny users="*" />
      <allow roles="Admins" />
    </authorization>
  </system.web>
</location>

Phil Haack has a good write up on the subject.