在ASP.NET站点上禁用调试

Question

Our security team wants me to disable debugging on an ASP.NET site that I have developed. They object to the server sending responses in response to a DEBUG request.

I have disabled debugging in the web config file using the tag.

I see that there are several machine.config and machine.config.default files on the server, and I have set retail="true" for the deployment tag in all of them, and the configuration editor in EES shows the retail attribute as true.

Still, when I point curl --trace - at my site, I still get trace information.

What else do I need to do?

Answer 1

Lets look at the curl --trace information you receive. The important thing is what ISAPI modules and handler are processing and handling the requests curl --trace sends.

Show the trace log.

Only standard Microsoft ISAPI modules and handlers have to obey the ASP.NET *.config parameters. If you are using some third-party modules on your server than you will have to look into their configuration.

Answer 2

Putting the appropriate tags in machine.config and web.config resolved the problem. It seems that our security is testing something different than what curl tests.