Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a site that uses a .net security module to secure certain areas of the website. It's not working, the pages that should be password protected are not. Other than that, the site doesn't throw any errors.

I don't have access to the code, and the module doesn't seem to log anything.

Is there an IIS or .Net log of loading/calling httpModules? I feel like it's not loading/calling it, and it's just not telling me.

My web.config has this snippet, which loads the module:


  <add name="MyApp.SecurityModule" type="MyApp.Host.Security.WebForms.SecurityModule" />

share|improve this question

Is this security module compiled into its own separate assembly (DLL)? If so, you might be able to detect whether the DLL is being successfully accessed by the IIS process (w3wp.exe) by using SysInternals procmon. Perhaps it's as simple as a file system permissions issue.

Have you checked the Windows Event log for any error messages?

Does the application use log4net or another logging framework? Perhaps you can change the logging level to DEBUG and see if anything is written to the application log.

You might try enabling page tracing in the web.config, and see if anything appears in the trace log.

share|improve this answer

Check Failed Request Tracing.

It will show you the entire pipeline and which modules are loaded etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.