Subfolders and security, please help!!

J

Jay

Hi,

I'm having some terrible difficulty setting up security on
sub-folders of my ASP.NET application. Here's essentially
what is happening:

1. I create my application at http://localhost

2. Since I'm creating it at the root, VS.NET gives it the
initial namespace, solution name, and project name as
localhost.

3. I change all of that to my project name. Let's
say "testsite"

4. I also rename WebForm1.aspx to Default.aspx

5. Then I build and test to make sure everything still
works. It does.

6. Next I right-click on the project name in my solution
explorer, and click "Add New Folder." I call my new
folder admin. And it's going to contain protected content.

7. Then I add a login.aspx file in the admin folder, and a
default.aspx in the admin folder. I set the default.aspx
in the admin folder as the start page.

8. I then add a web.config file in the Admin folder. I
set it up to use forms authentication and deny all
anonymous users.

----------------------------

At this point, I "think" everything should work fine.
When the solution builds, it should try to launch the
default.aspx folder in my Admin subfolder, realize I
haven't been authenticated, and send me to the login.aspx
page in my admin subfolder.

Of course, it doesn't work. I get some strange error
suggesting the the admin subfolder needs to be setup as an
application in IIS.

Let me continue...


9. I go into IIS and setup the admin subfolder as an
application.

10. After that I can't even get the login.aspx page to
load up. I get an error: can't load type
testsite._default or something like that

11. At this point, I can't get anything else to work in
the site. If I tell IIS that the admin folder is not an
application, then I get one error... if I create it as an
application, I get another.

-------------------------------

So here's what I want:

A) I want my root default website on my Windows XP pro
machine to be called something other than "localhost" when
I setup the vs.net project. I think I know how to do this.

B) I want to be able to create a sub-folder called "Admin"
and have all pages in that folder protected by forms
authentication (with the exception of course of the
login.aspx page itself)

C) Any other pages off the root website should not be
protected.

D) I'll likely have a couple more sub-folders off the main
root website I'll want protected, too.

Anyone have any suggestions?

Thanks very much.
 
E

Eugene Jenihov

Hi...

You can use location element in root web.config
<configuration>
<location path="Logon.aspx">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
</configuration>
 
J

Joe Audette

If the admin folder is protected by the web.config, I
don't see how the login page could be in the admin
folder. It would not let you get to the login page
becuase you're not logged in. The login page needs to be
in an un-protected folder.

Joe
 
G

Guest

Hi Joe,

Yes, that seems like a logical assumption. But actually I
believe Microsoft built .NET taking that into
consideration. I'm always able to get to the URL I
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,769
Messages
2,569,581
Members
45,055
Latest member
SlimSparkKetoACVReview

Latest Threads

Top