location element in web.config


F

Fred

Hello,

I made a little web site to share some files with a very few users.
I used aspnet membership and roles.
There are a few aspx files at the root. No problems to control access
for these files using the location element and roles.
Now, I created a folder private with one sub folder for each user.
ex : ~/private/userA
I added this in the root web.config (in the configuration element)

<location path="private/userA">
<system.web>
<authorization>
<allow users="userA"/>
<allow roles="admin"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

If I store a file in userA folder, I can get it, even if I am not
authenticated.

in <configuration><system.web>, I wrote this
<authentication mode="Forms">
<forms name=".ASPXAUTH" loginUrl="Default.aspx"/>
</authentication>
<authorization>
<deny users="*" />
</authorization>

Where is my error ?
 
Ad

Advertisements

F

Fred

Dans : Fred disait :
Hello,

I made a little web site to share some files with a very few users.
I used aspnet membership and roles.
There are a few aspx files at the root. No problems to control access
for these files using the location element and roles.
Now, I created a folder private with one sub folder for each user.

If I store a file in userA folder, I can get it, even if I am not
authenticated.
Where is my error ?

OK, I found.
I have to tell IIS that aspnet_isapi.dll will be call for every kind of
file.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top