My web app (under development) need to login via http://devWebServer/ExtApp/login.aspx

After login via address above, it will pass cookie to http://devWebServer/myApp/Login/Default.aspx and continue from here.

I find it troublesome that every time I need to deploy my code to http://devWebServer/myApp and do testing from there because of the login.

What are the industry standard to debug under this circumstance?

is using project properties -> Web -> Servers -> External Host -> set as http://devWebServer/myApp going to solve my issue? I cannot test this now because of security policy, firewall.

I am reluctant to write if loginViaExtApp (do this) else (do that) or something similar in my web app.

  • 1
    Questions about how to use your programming tools belong on Stack Overflow. – Robert Harvey Jan 5 '18 at 16:17
  • @RobertHarvey I think I don't have the reputation to migrate question? What are my options? – Pop Jan 8 '18 at 1:13

This is fairly easy to do with a combination of compiler flags and system environment variables.

  1. Add code at the spot where you log the user in that bypasses the authentication check

        if ("true".Equals(Environment.GetEnvironmentVariable("ALLOW_FAKE_AUTHENTICATION"), StringComparison.CurrentCultureIgnoreCase))
            // Code to "log" fake user in without checking password
            throw new Exception("No-way");
        // Actually check user and password

    Yes, invent your own compiler flag and name it something obvious, like "FAKE_AUTHENTICATION" to make sure people understand what you are doing.

  2. Add the FAKE_AUTHENTICATION flag to the project properties under the proper build configuration

  3. Add the ALLOW_FAKE_AUTHENTICATION system environment variable

Now if you accidentally deploy this to a real server, you'll get nothing more than a crashing web app.

If an attacker manages to add an environment variable to one of your servers, you've got WAAAAAAAAY bigger problems to deal with than a compiler flag.


You could use a setting in the web.config file with an <appsetting> flag to let the app know that it should bypass login via the web server.

However, what you will have to do is to code the logic to create the cookie or bypass the cookie too if the flag is found in the <appSettings> is found.

Also, you will need to remove the flag when deployed to the server. This can be easily done with a web.config transform.

  • But I am reluctant to do that because there is risk, what if I forget to remove flag when deploy to production server? – Pop Jan 5 '18 at 3:03
  • 3
    @Pop: I assume you have your applications compiled in "debug" mode when debugging them, and in "release" mode before deploying them to production. Then you can test for that flag in a code section which is enclosed by #ifdef DEBUG. – Doc Brown Jan 5 '18 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.