Elmah on Production Server

Question

I have started using Elmah for this project and I find it very useful, however I have a question.

If you install it on the production server, wouldn't it be a hacking risk? I mean the thought behind not showing the Yellow Screen of Death is also not to give information to hackers on your site.

Isn't this information also shown with elmah? How would you go around this? Logging errors in the database?

Thanks for your opinions

Answer 1

You have to secure your elmah page with login / password (because it contains session cookie, form parameters ... ).

I did like this : create a folder on your website root named "log" change its security setting for allowing only domain admin.

then in you web.config change your httphandler from "elmah.axd" to "log/elmah.axd" so when you'll try to access elmh it'll ask for your credentials.