web.config protect directory

[Ryan Moore]

is it possible to protect a single directory within a virtual directory
using that directory's web.config file (for example, the "admin" folder
within a web directory)? If so, how is it done?

thnx

 

[Chris Jackson]

You can drop in a web.config into a child directory, and simply override the
defaults that you have in the parent for the properties that you want to
override. So, for example, if you want to require all users to be
authenticated, you could put in:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<authorization>
<deny users="?" />
<allow users="*" />
</authorization>
</system.web>
</configuration>

All other properties will be carried over, and just the authorization
over-ridden. You can customize based on who you want to authorize.

 

[toucomxono]

define folder protection with login form

Hi,

I have a webApp with a web.config file in it's root folder. In that config file I have defined the forms authentication and login forms that works perfect.

Meanwhile I added an extra folder (called backoffice) that I also want to protect. I want to use a different config file to protect this folder and used the code you posted. Does the protection also includes the sub-folders of the Backoffice folder?

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
  
  <system.web>
    
    <authentication mode="Forms">
      <forms loginUrl="~/BackOffice/Login.aspx" name=".ASPXFORMSAUTH" protection="All" timeout="30" path="/" defaultUrl="~/BackOffice/Login.aspx" />
    </authentication>
    
    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>
    
  </system.web>

</configuration>

Is this correct? Can I define this? When I compile gives me the following message:

It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.

I'm using Visual Web DEveloper Express.

Best regards,
Manuel