A preferred way to check if asp.net web application is in debug mode during runtime?

Question

During compile time I can do a check like

#if DEBUG
    Log(\"something\");
#endif

But what would be the preferred to check if debug=\"f

Answer 1

HttpContext.IsDebuggingEnabled

https://docs.microsoft.com/en-us/dotnet/api/system.web.httpcontext.isdebuggingenabled

Answer 2

In some cases, you may need HttpContext.Current.IsDebuggingEnabled (sort of obvious, but nonetheless)

Answer 3

There's another, non-programmatic external and empirical way to check if you've accidentally left the debug=true attribute on system.web/compilation on a Asp.Net website, i.e. to detect if you've left this configuration on in web.config:

 <system.web>
    <compilation debug="true" targetFramework="xxx"/>

By using a tool such as Fiddler, you can intercept a GET request to your web site, and then change this so that to issue a non-Standard DEBUG HTTP Verb to the site, along with an extra Command: stop-debug Header.

• Select a GET request to your site and drag it into the Composer
• Switch to the Raw tab (since DEBUG isn't a standard HTTP verb option)
• Edit the Verb from GET to DEBUG
• Add an extra Command: stop-debug Header (above the Cookies), but leave the rest of the Headers and Cookies in place
• Execute the DEBUG command

If the Web site returns 200 and the content OK, then you know you've left debug on. The web site will return 403 - Forbidden if debug is off.

If you've got your website building on a CI/CD build pipeline, best way to turn debug off is to add the following XDT in your Web.Release.config

<system.web>
  <compilation xdt:Transform="RemoveAttributes(debug)" />
</system.web>

(Turning debug off in Production is a common security audit requirement)