A preferred way to check if asp.net web application is in debug mode during runtime?
HttpContext.IsDebuggingEnabled
https://docs.microsoft.com/en-us/dotnet/api/system.web.httpcontext.isdebuggingenabled
In some cases, you may need HttpContext.Current.IsDebuggingEnabled
(sort of obvious, but nonetheless)
There's another, non-programmatic external and empirical way to check if you've accidentally left the debug=true
attribute on system.web/compilation
on a Asp.Net website, i.e. to detect if you've left this configuration on in web.config:
<system.web>
<compilation debug="true" targetFramework="xxx"/>
By using a tool such as Fiddler, you can intercept a GET request to your web site, and then change this so that to issue a non-Standard DEBUG
HTTP Verb to the site, along with an extra Command: stop-debug
Header.
- Select a GET request to your site and drag it into the Composer
- Switch to the
Raw
tab (since DEBUG isn't a standard HTTP verb option) - Edit the Verb from
GET
toDEBUG
- Add an extra
Command: stop-debug
Header (above the Cookies), but leave the rest of the Headers and Cookies in place - Execute the
DEBUG
command
If the Web site returns 200 and the content OK
, then you know you've left debug on. The web site will return 403 - Forbidden
if debug
is off.
If you've got your website building on a CI/CD build pipeline, best way to turn debug off is to add the following XDT in your Web.Release.config
<system.web>
<compilation xdt:Transform="RemoveAttributes(debug)" />
</system.web>
(Turning debug off in Production is a common security audit requirement)