If you’re working with an older ASP.NET application running under Medium Trust, you may run into a common problem: your application can read Web.config, but attempting to modify it at runtime fails with a security or permission exception.
The important point is that Medium Trust is designed to restrict applications from modifying configuration files. Simply using Server.MapPath() and File.WriteAllText() is not a reliable solution—and in a hosted environment, it will generally be blocked by filesystem permissions or the trust policy.
What can you do?
If you need to change configuration dynamically, consider these approaches:
- Store dynamic settings outside Web.config
Instead of modifying Web.config, use a data store such as a database or another configuration mechanism that your application is allowed to write to.
// Example: store application settings in a database
string value = GetSettingFromDatabase("MySetting");
- Use an application-level configuration file
For settings that need to be writable, keep them in a separate file, provided your hosting environment allows your application to create and modify that file.
string path = Server.MapPath("~/App_Data/settings.xml");
File.WriteAllText(path, "Value");
App_Data is commonly used for application data because it isn't intended to be served directly to clients.
- Change Web.config during deployment
If the configuration really belongs in Web.config, the safest approach is usually to modify it as part of your deployment process rather than from application code.
For example:
Your deployment process can generate or transform the appropriate configuration for each environment.
What about ConfigurationManager?
You can read configuration values normally:
string value =
ConfigurationManager.AppSettings["MySetting"];
But being able to read configuration doesn't mean the application has permission to write the physical Web.config file.
Bottom line
Under Medium Trust, don't design your application around runtime modification of Web.config. If a value needs to change while the application is running, keep that value in a writable data store or separate configuration file. If it belongs in Web.config, update it during deployment.
This approach is more secure, more predictable, and works better with hosted ASP.NET environments.
