Folder protection with webconfig

[lupis]

Hi,

I am new to asp.net and I have subfolder in my rootfolder with files that needs to accessed by username and login from a loginpage. I have currently one default.aspx that I access this way in the root folder. This is a extract from my current webconfig file in the root folder:

<authentication mode="Forms">
      <forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">
        <credentials passwordFormat="Clear">
          <user name="Member" password="xxx"/>
          
        </credentials>
      </forms>
    </authentication>
    <authorization>

      <deny users="?"/>

    </authorization>

But I want to move this page and have additional pages in a subfolder that are only accessed by the above mentioned credentials in my root webconfig file.

This is the function I am using on the Login.aspx page in my root folder:

Sub ProcessLogin(objSender As Object, objArgs As EventArgs)

  If FormsAuthentication.Authenticate(txtUser.Text, txtPassword.Text) Then
     FormsAuthentication.RedirectFromLoginPage(txtUser.Text, chkPersistLogin.Checked)
  Else
     ErrorMessage.InnerHtml = <font color="red">"<b>Nåt gick fel...</b>var vänlig och kontollera användarnamn samt lösenord..."</font>
  End If

All the pages in the subfolder will have the following code:

Sub Page_Load()
  'verify authentication
  If User.Identity.IsAuthenticated Then
    'display Credential information
            displayCredentials.InnerHtml = "  You are logged in as: " & User.Identity.Name
               
            '<br>Authentication Used : <b>" & User.Identity.AuthenticationType & "</b>"
  Else
    'Display Error Message
    displayCredentials.InnerHtml = "Sorry, you have not been authenticated."
  End If
End Sub

    Protected Sub lnkLogut_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles lnkLogut.Click
        
        'delete the users auth cookie and sign out
        FormsAuthentication.SignOut()
        'redirect the user to their referring page
        Response.Redirect(Request.UrlReferrer.ToString())
    End Sub

Every page in the root folder should be accessable by everyone, but only the pages in the subfolder should be accessed by login.

Thanks
Sohail