If you dig a little digger, you'll notice that I use the WebConfigController only when I need to write to web.config. That is, during the install and upgrade wizards. One cannot use the Configuration API to write to web.config (or galleryserverpro.config) in medium trust scenarios.

There is a long story here. A few years ago I worked with MS to figure out how to get their Configuration API able to update web.config and galleryserverpro.config in medium trust. Both of these files are contained within the web application directory, so there isn't a good reason why it cannot be done. After all, the API was released with .NET 2.0 to much fanfare as the best way to handle configuration settings. In the end, they said it can't be done.

I submitted a feature request on MS Connect to make it so it *can* be done. They ended up closing it out and saying that the configuration settings are not designed to be updated in a live web application and that this feature was not in scope. I think they came to realize the limitations of their configuration architecture and started backing away from it.

So, as a workaround, if I want to update these files in medium trust, I have to manually do it. Hence the parsing of these files that you see.

The other big downside with the configuration system is that the app must restart each time a setting is changed. Not cool.

At some point I may move away from this architecture, but GSP has a lot invested in it at this point so it is not a high priority.

That is fine if you want to create an app setting called GalleryServerProPath, but that means you end up defining the path in two places (the other being the line <galleryServerPro configSource="gs\config\galleryserverpro.config" />). I want to make GSP easy to install and maintain, so if I can write a function that saves the administrator from having to define a path twice, it is worth it.

Thanks for your input.

GSP already uses ConfigurationManager in all situations except installing and upgrading. Furthermore, this information is cached by GSP in static variables. I don't think you'll be able to improve the performance, but knock yourself out trying. :-)

I don't think changing the extension to .xml will make the Configuration API start working in medium trust. The config system in .NET works by combining all the config settings, starting with machine.config all the way down to local config files. Because medium trust apps cannot write to files outside the web directory, any attempt at writing fails, because it *potentially* updates machine.config.

My position that I have stated to MS is that this is poor architecture and needless hampers web sites, but as I said they are not correcting it.