MultifactorLab/MultiFactor.SelfService.Windows.Portal 1.0.207

Release 1.0.207

on GitHub

10.11.2026 v1.0.207

Release 1.0.207

Security

• Log files can no longer be downloaded over HTTP: logs are now written to App_Data\Logs, which IIS never serves, instead of Logs in the site root
• The default Web.config now contains a requestFiltering block that denies direct access to the Logs folder and to service files (keys and certificates, backups, logs, archives, configuration files)

Features

• New optional logging-path setting for a custom log directory (absolute or relative to the portal folder)

Upgrade notes ( IMPORTANT )

• Logs are now written to App_Data\Logs. Grant the application pool identity (IIS AppPool\DefaultAppPool by default) write access to this folder, otherwise logs will not be written. Move or delete the old files from Logs
• If you keep your own Web.config, copy the <security> block from <system.webServer> of the shipped Web.config into yours. Without it, old logs and other service files in the site folder remain downloadable
• To keep the old log folder, set <add key="logging-path" value="Logs"/>. Do this only together with the <security> block above, otherwise the logs stay readable without authentication