Write access to web.config

[Asim]

What are the security risks to grant ASP.NET user write access to web.config?
I am working on a project in which I am required to update web.config at the
runtime, basically modifying access to different directories.

Any suggestion will be greatly appreciated.

Thanks

 

[Ken Cox [Microsoft MVP]]

Hi Asim,

There are certainly serious security risks in doing this. You might want to
consider storing the configuration information in some other place like a
database rather than the web.config.

I'd also worry about performance problems because whenever you change the
web.config, the Web application resets and will want to recompile.

Ken

 

[Patrick Olurotimi Ige]

Asim..
I don't advice updating or modifying web.config files at anytime UNLESS
u need to do so..
GDLUCK
Patrick