Security for ASP.NET Diagnostics Page
I'm going to create a diagnostics page for an ASP.NET application, which is mainly for use by an administrator to get more information about the application to diagnose problems.
Examples of information that a page may have:
- System.Environment.MachineName (may be useful in web farm scenarios)
- System.Environment.Version
- Environment.UserName
- database name
- session id of the current user
Some information on this page may be security sensitive. If you've made a page like this before, what kind of security have you included on this page?
EDIT:
I must add - it would sometimes be helpful to see this page at login time as a specific (i.e. real) end user. for example, it is said that the problem can only be reproduced when logged in as a specific user. It may be helpful to be able to view the diagnostic page for this user. for example knowing that the current session id can be useful for debugging.
EDIT 2:
I'm starting to think that this diagnostic page should actually be two different pages. One to display content that is the same for all users (eg, database name, CLR version) and another for content that can vary by session (eg, browser information, session ID). Then you can block security for the first page.
a source to share
Yes, I added this page before (and found it helpful). The security was pretty straightforward: the page contained a password form. The server side code checked this password against the configured value and, if correct, rendered the real content and set the value in the user session to say they were authenticated as a developer so that they are not prompted again.
I suppose there was little obscurity in there, since the page url was not published anywhere.
I also tried not to reveal anything really sensitive on the page. For example, it allowed us to view our application config values, but masked anything with a "password" in it. Hey, if we really want to see the password, we can open a remote desktop session to the server.
a source to share
There are several other ways you could do this:
-
If your web application has user authentication, restrict access to this page by setting that the user is marked as an administrator or belongs to an administrator role.
-
Use a simple type check
if (Request.IsLocal) ...
, although the downside to this is that you still have to connect to the server and browse the website locally, which is not always possible. However, this still has the advantage of making it easy to view basic system settings.
Personally, I've used a combination of both methods where local request always allows access, and non-local requests require an admin user - eg. if (!Request.IsLocal && !IsAdminUser()) throw new SecurityException()
...
Also, I agree with Eugene - be careful not to show anything really sensitive on this page (like app connection strings or passwords).
a source to share
It sounds like you need a robust solution for your error page. I would look at open source projects like Elmah ( http://code.google.com/p/elmah/ ) for a good example of a robust error page that includes custom security. To give you an idea, here is a post on configuring Elmah to help you configure security. The security I've verified allows me to use my login credentials.
a source to share