Show DeveloperExceptionPage in production but for 'Remote Only" - asp.net-mvc

Question

I understand that the debug error page should not be seen by the end user.
However in the past, I have always been able to configure my production deployment to hide this information (so show a custom or generic error page) when called remotely, but still show the exception/stacktrace debug error, as long as I called it direct from the webserver it was hosted on.
Now looking at the latest MVC/RazorPages way, is it the case this is no longer possible, and it is either on or off, depending on the environment variable?
Before:
Within Web.Config, I use to be able to do something like:
<system.web>
<customErrors mode="RemoteOnly" </customErrors>
Now:
In Startup.cs:
I can see
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Error");
}
... but I cannot see a way to allow "app.UseDeveloperExceptionPage();" when env.isDevelopement == false, but the call is local.
I am hoping I am missing something, rather than something that has now been removed.

Answer 1

You could possible extend DeveloperExceptionPageMiddleware, or create your own copy, using Url.IsLocalUrl to only display the error view on localhost.

Answer 2

I got it to work (all thanks to others on here). Hopefully it might help others to see the bits I needed, in one place.
First to address identifying if the call is local:
As for:
Url.IsLocalUrl
Supposedly it works, but is 'spoofable'. Given that it could reveal source-code/debug, the guys on this page (In ASP.NET Core how do you check if request is local?) suggest something more like:
public static class HttpContextFilters
{
public static bool IsLocalRequest(HttpContext context)
{
if (context.Connection.RemoteIpAddress.Equals(context.Connection.LocalIpAddress))
{
return true;
}
if (IPAddress.IsLoopback(context.Connection.RemoteIpAddress))
{
return true;
}
return false;
}
public static bool IsRemoteRequest(HttpContext context)
{
return !IsLocalRequest(context);
}
}
I can now call in Statup.cs:
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseWhen(HttpContextFilters.IsLocalRequest, configuration => configuration.UseDeveloperExceptionPage());
app.UseWhen(HttpContextFilters.IsRemoteRequest, configuration => configuration.UseExceptionHandler("/Error"));
}
For an alternative solution, I suspect #Jon Galloway's approach would yield a more elegant and expandable solution...
Something along the lines of:
public class MyDeveloperExceptionPageMiddleware : Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware
{
private readonly RequestDelegate _next;
public MyDeveloperExceptionPageMiddleware(RequestDelegate next,
IOptions<DeveloperExceptionPageOptions> options,
ILoggerFactory loggerFactory,
IHostingEnvironment hostingEnvironment,
DiagnosticSource diagnosticSource) : base(next, options, loggerFactory, hostingEnvironment, diagnosticSource)
{
_next = next;
}
public async new Task Invoke(HttpContext httpContext)
{
if (HttpContextFilters.IsLocalRequest(httpContext))
{
//Show dev exceptions page
await base.Invoke(httpContext);
return;
}
await _next(httpContext);
return;
}
public static class MyDeveloperExceptionPageMiddlewareExtensions
{
public static IApplicationBuilder UseMyDeveloperExceptionPageMiddleware(this IApplicationBuilder builder)
{
return builder.UseMiddleware<MyDeveloperExceptionPageMiddleware>();
}
}
Then in StartUp.cs do:
app.UseMyDeveloperExceptionPageMiddleware();
For some reason though (due to my ineptness), I couldn't quite get VS to like debugging it, but appeared to work when run from a web server. However, for what I need, and also given the fact that it would need finishing off to handle the custom error page, I think the simplified down and dirty approach above, is enough for me.