title: Securing ELMAH while yet making it possible to access it via RSS Reader
body: <p>We use ELMAH error exception logging in our application. I'd like to keep ELMAH secure from regular users while still making it available to administrators/developers of the application.  </p>
  
  <p>When you set security with forms authentication in the web.config you then lose the ability to access the RSS feed.  I'd like to be able to secure ELMAH but yet still pass through authentication to the axd to be able to access the RSS feed (i.e. /elmah.axd/rss) from a RSS reader.  </p>
  
  <p>Thinking that http authentication would be proper as then I can probably get to the rss feed with the following url syntax <a href="http://username:password@somedomain.com/elmah.axd/rss" rel="noreferrer">http://username:password@somedomain.com/elmah.axd/rss</a> I assume you would need to set authentication mode="windows" on that specific path in the web.config.  One issue pops up though is how do you set credentials on a virtual file?</p>
  
  <p>Looking at Google brings back this <a href="http://www.codeproject.com/KB/web-security/basicauthen.aspx" rel="noreferrer">article on CodeProject</a> on how to set up authentication passthrough with cookies. Is this a good solution to my problem?  </p>
  
  <p>Is there another way that is better to be able to access the RSS feed while still being secure?</p>
  
  <p>Thanks. </p>