Umbraco developers - remember to disable the umbDebug settings when you go live
Friday, October 28, 2011 12:05:41 PM (GMT Daylight Time, UTC+01:00)
Recently I've noticed a growing number of Umbraco developers forgetting to disable the Umbraco debug settings before going live. We all fall foul of this from time to time but it is a security loophole that you can patch incredibly easily.
If you're not familiar with the helpful debugging querystring parameters of umbDebug and umbDebugShowTrace they basically show you the ASP.Net trace output and highlight the various macros used on the page -there's also a useful toggle debugging in Umbraco bookmarklet on cpalm.dk.
Why you should disable trace
If you try it out on your site which has debugging enabled you'll get all sorts of helpful information output to the page including where your website is installed -all very helpful and interesting to hackers. It also identifies your site as an Umbraco site very quickly -again something you would want to avoid if at all possible.
How to disable the debug settings via the web.config
Umbraco helpfully has a built in flag in the web.config appSettings section which allows you to effortlessly toggle the debuging features on/off. To turn it off, search for "umbracoDebugMode" in your web.config and if it's set to "true", change it to false.
<add key="umbracoDebugMode" value="true" />
Should be:
<add key="umbracoDebugMode" value="false" />
For good measure you should also change ASP.Net's built in debug flag:
<compilation defaultLanguage="c#" debug="true" batch="false" targetFramework="4.0">
Should be:
<compilation defaultLanguage="c#" debug="false" batch="false" targetFramework="4.0">
Disable it using UrlRewriting.config
If you prefer the belts and braces method, you can add a rule to your UrlRewriting.config to redirect the user everytime the url includes something that looks suspicious. To do this, just add the following rewrites to your UrlRewriting.config (or replace it completely if you don't have any rules):
<urlrewritingnet xmlns="http://www.urlrewriting.net/schemas/config/2006/07">
<rewrites>
<add name="nodebugaspx"
virtualUrl="(.*).aspx.*umbDebug.*"
rewriteUrlParameter="IncludeQueryStringForRewrite"
redirect="Application"
destinationUrl="~$1.aspx"
ignoreCase="true" />
<add name="nodebug"
virtualUrl="(.*).*umbDebug.*"
rewriteUrlParameter="IncludeQueryStringForRewrite"
redirect="Application"
destinationUrl="~$1"
ignoreCase="true" />
</rewrites>
</urlrewritingnet>