Elmah.MVC 2.0.1 - securing the elmah logs

asp.net-mvc-4, elmah, elmah.mvc

Solution

Ouch!

Just found the answer;

Elmah MVC 2.0.1 NuGet package adds the following into `<appSettings>` (in web.config):

<add key="elmah.mvc.requiresAuthentication" value="false" />
<add key="elmah.mvc.allowedRoles" value="*" />

To achieve what I want simply:

<add key="elmah.mvc.requiresAuthentication" value="true" />
<add key="elmah.mvc.allowedRoles" value="Admin" />

Problem

Setup: For an ASP.NET MVC 4 app I am using Elmah.MVC 2.0.1 to log errors. I installed Elmah.MVC using NuGet. It works fine. Problem: The Elmah.MVC package installs no controller or area, so I can see no obvious way to apply security via Authorize attributes, as is recommended for ASP.NET MVC. Question: I only want users in the Admin role to be able to view the Elmah page. How do I do this?

Original source