Secure ELMAH in asp.net application that doesn't use forms authentication

Question

I have a very basic asp.net application that relies on a master page's INIT event to verify the user via a session object. Yes, I know this is way-suboptimal.

I'd like to add ELMAH to it, but can't find any references to securing the console without using forms authentication and a web.config allow/deny setting.

Is there another way to secure the elmah.axd file that doesn't rely on forms authentication?

Answer 1

Out of the box, remote access is disabled so you can only access the error logs from the local machine. There's more here: http://code.google.com/p/elmah/wiki/SecuringErrorLogPages

Answer 2

This article describes how to wrap the Elmah error handler in another event handler that allows access to session state:

http://groups.google.com/group/elmah/msg/a0aa776d348ba97e

In Global.asax, you could then have something like the following:

protected void Application_PreRequestHandlerExecute(Object sender, EventArgs e)
{
    // Get the filename being requested
    string filename = Path.GetFileName(Request.Path).ToLower();

    // Verify that a user is logged in by checking the session
    bool isValid = (HttpContext.Current.Session["User"] != null);

    // Throw error if invalid
    if (filename == "elmah.axd" && !isValid)
        throw new SecurityException("Access to elmah.axd is denied");
}

The standard Elmah handler doesn't implement IRequiresSessionState or IReadOnlySessionState, so you'll have to create another event handler to wrap this, as described in the link mentioned above. Otherwise, you won't be able to access the session in the Application_PreRequestHandlerExecute event.

Answer 3

I am one of the developers for ELMAH's MySQL support. The allow/deny options are not web form specific. They can work with any provider.

1. To impliment a custom one you would need to use the IPrincipal interface.
2. The roles from allow/deny roles are pulled from this IsInRole method of IPrincipal.

3. On the Request_Authentication in your global.asax or your own IHttpHandler you would need to create and set the IPrincipal object to the Context.User object. Something like this:

   private void Request_Authenticate (object sender, EventArgs e) {
       // do checks and create IPrincipal object
       IPrincipal user = new MyPrincipal(...);
       Context.User = user;
   }
   

4. Then when the roles are checked for your elmah.axd handler it would go against this custom object instead of the web forms.