Detect and warn insecure web.config settings - Githubissues

CompuMasterGmbH / cammIntegrationPortal

camm Integration Portal (based on camm Web-Manager)

MIT License

2 stars 1 forks source link

Detect and warn insecure web.config settings #43

Open jochenwezel opened 7 years ago

jochenwezel commented 7 years ago

If web.config has one of the following settings, a daily warning mail should be sent on ApplicationInit or even better on EndOfFirstRequest

[ ] for root web app
[ ] for all web apps

Watch out for settings

[ ] compilation debug=true
[ ] customErrors=Off
[ ] appSetting NotifyOnApplicationException<2 (as long as there is no setting for NotifyOnMissingExceptionHandling=Off (default: On))
[ ] missing CwmHttpApplication (as long as there is no setting for NotifyOnMissingExceptionHandling=Off (default: On))