0

Our organization gets a lot of ticket requests from the Marketing department to create friendly URLs for our production public facing sites. I'm considering creating a simple internal ASP.NET web form application that will allow them to view and modify the URL rewrite mappings. The app would essentially be a front end for the web.config XML.

The purpose is to streamline the mapping process without providing server/IIS access to non-IT staff.

Are there considerations that would make this ill-advised? This is assuming the modify code is solid and implements all the appropriate validations so malformed XML doesn't break the site.

Alternatively, if there already products which provide the same functionality reliably that would be an option too.

Kevin Denham
  • 131
  • 6

1 Answers1

0

If you proceed with your approach, I would at least move all the rewrite rules into a different file, e.g. rewrite.config:

 <rules>

   <!-- Rewrite Rules, this gets included in web.config during runtime -->

     <rule name="AspNetTrace" stopProcessing="true">
         <match url="trace\.axd" />
         <action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Trace not allowed" />
     </rule>  

 </rules>

and in your web.config, only have something like this:

<rewrite>
   <rules configSource="rewrite.config" />
</rewrite>

then make sure your Application Pool identity has write access to rewrite.config but not to web.config

You usually don't want the web.config file to be update-able from the site itself, an incorrect rule can also break the whole site, so I would be very careful with this.

Peter Hahndorf
  • 13,763
  • 3
  • 37
  • 58