A preferred way to check if asp.net web application is in debug mode during runtime?

During compile time I can do a check like

#if DEBUG
    Log("something");
#endif

But what would be the preferred to check if debug="false" is set in Web.config during runtime?


HttpContext.IsDebuggingEnabled

https://docs.microsoft.com/en-us/dotnet/api/system.web.httpcontext.isdebuggingenabled


In some cases, you may need HttpContext.Current.IsDebuggingEnabled (sort of obvious, but nonetheless)


There's another, non-programmatic external and empirical way to check if you've accidentally left the debug=true attribute on system.web/compilation on a Asp.Net website, i.e. to detect if you've left this configuration on in web.config:

 <system.web>
    <compilation debug="true" targetFramework="xxx"/>

By using a tool such as Fiddler, you can intercept a GET request to your web site, and then change this so that to issue a non-Standard DEBUG HTTP Verb to the site, along with an extra Command: stop-debug Header.

  • Select a GET request to your site and drag it into the Composer
  • Switch to the Raw tab (since DEBUG isn't a standard HTTP verb option)
  • Edit the Verb from GET to DEBUG
  • Add an extra Command: stop-debug Header (above the Cookies), but leave the rest of the Headers and Cookies in place
  • Execute the DEBUG command

If the Web site returns 200 and the content OK, then you know you've left debug on. The web site will return 403 - Forbidden if debug is off.

Fiddler Screenshot

If you've got your website building on a CI/CD build pipeline, best way to turn debug off is to add the following XDT in your Web.Release.config

<system.web>
  <compilation xdt:Transform="RemoveAttributes(debug)" />
</system.web>

(Turning debug off in Production is a common security audit requirement)