How to Write to Web.config in Medium Trust

Fri, 02 Oct 2026 03:37:53 +0000

If you’re working with an older ASP.NET application running under Medium Trust, you may run into a common problem: your application can read Web.config, but attempting to modify it at runtime fails with a security or permission exception.

The important point is that Medium Trust is designed to restrict applications from modifying configuration files. Simply using Server.MapPath() and File.WriteAllText() is not a reliable solution—and in a hosted environment, it will generally be blocked by filesystem permissions or the trust policy.

What can you do?

If you need to change configuration dynamically, consider these approaches:

Store dynamic settings outside Web.config

Instead of modifying Web.config, use a data store such as a database or another configuration mechanism that your application is allowed to write to.

// Example: store application settings in a database
string value = GetSettingFromDatabase("MySetting");

Use an application-level configuration file

For settings that need to be writable, keep them in a separate file, provided your hosting environment allows your application to create and modify that file.

string path = Server.MapPath("~/App_Data/settings.xml");

File.WriteAllText(path, "Value");

App_Data is commonly used for application data because it isn't intended to be served directly to clients.

Change Web.config during deployment

If the configuration really belongs in Web.config, the safest approach is usually to modify it as part of your deployment process rather than from application code.

For example:

Your deployment process can generate or transform the appropriate configuration for each environment.

What about ConfigurationManager?

You can read configuration values normally:

string value =

ConfigurationManager.AppSettings["MySetting"];

But being able to read configuration doesn't mean the application has permission to write the physical Web.config file.

Bottom line

Under Medium Trust, don't design your application around runtime modification of Web.config. If a value needs to change while the application is running, keep that value in a writable data store or separate configuration file. If it belongs in Web.config, update it during deployment.

This approach is more secure, more predictable, and works better with hosted ASP.NET environments.

Coder Legion - Recent posts tagged medium-fast

How to Write to Web.config in Medium Trust