Excluding certian pages from Forms authentication

[Guest]

Hi,

I've a web application and I'm using Forms authentication. My app contains
some pages that can be viewed by everyone and it doesn't require any
authentication or authoization and these pages mostly come at the start of
the application. After a couple of such 'general' pages, the login screen
comes. How do tackle this situation? Advance thanks for throwing any light on
this

 

[Steve C. Orr [MVP, MCSD]]

Every folder can have its authentication configured separately.
Therefore you can have certain folders that allow anonymous users.

Here's more info:
http://www.dotnetbips.com/displayarticle.aspx?id=117

 

[Guest]

Hi,

Thanks very much for the info provided. I'll try as per your suggestion.

 

[Guest]

Hi,

You can also try using a Location Tag with Authorization in the Web.config.
Here is a example of the web.config, where the below used pages do not need
authentication.

<location path="Default.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>

<location path="GenericErrorPage.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
--

This is an easier approach than having to maintain multiple directories and
multiple web.configs.
Hope this was helpful.

--Vijay R

 

[Michael D. Ober]

Based on this - if I need a web-site that has a mix of non-secure, secure
without authentication, and secure with authentication pages, I can put the
non-secure and secure without authentication pages on one site and create a
virtual site for the secure with authentication pages and then have the
pages link back and forth? My question in this case is how do I keep the
login information should someone jump from the authenticated site to the
non-authenticated site and back.

Mike Ober.

 

[Guest]

Hi,

You can keep the login information in a windows custom security object
(Windows Identity and Windows Principal) and save the object.
Then restore back the object when the user re-enters the authenticated site.
But the catch is doing this in a secure manner.
That is you have to keep track of a user when he enter the non-auth site and
then re-enters the auth site. you have to be sure that it is the same
user?????
Since this is a problem, it is always safe and easier to have the user login
again if he re-enters the auth site.


Regards
--Vijay R