CODEWITHSUNDEEP
c#asp.net
Nate Pet
Nate Pet

Reputation: 46322

c# authentication for only subdirectory for any user

Note this is is a slight variation on a previous question that I had..

I am using c# .NET Web Forms 4.0

I have a folder like the following that I need to password protect so anybody(any external users can also view site) wanting to view the page needs to first enter a userid, password (that we tell them) in order to view the page.

example:

    www.abc.com/srlv/

so under srlv I have web pages that need to be password protected.

Note that we need to authenticate only if the user goes to a file under /srlv/

Note that these are .html files, not .aspx files. 

      www.abc.com/srlv/index.html, www.abc.com/srlv/about.html

but if the user goes to say www.abc.com it will allow them to view the website without any authentication

I was thinking of using the following:

    <authenticaton mode="Forms">
    <forms loginUrl="/srcs/login.aspx" timeout="30" defaultUrl="/srlv/index.aspx" cookieless="UseUri">
    <credentials passwordFormat="Clear">
    <user name="Usw" password="pass123"/>
    </credentials>
   </forms>
   </authentication>

but how do I say authenticate only if you go to any files within

    www.abc.com/srlv/

Upvotes: 0

Views: 771

Answers (3)

2GDev
2GDev

Reputation: 2466

Location can help you..

http://support.microsoft.com/kb/316871

Simply get access to all unauthorized users and block only specific folder. 

<configuration>
    <system.web>
        <authentication mode="Forms" >
            <forms loginUrl="login.aspx" name=".ASPNETAUTH" protection="None" path="/" timeout="20" >
            </forms>
        </authentication>
<!-- This section denies access to all files in this application except for those that you have not explicitly specified by using another setting. -->
        <authorization>
            <deny users="?" /> 
        </authorization>
    </system.web>
<!-- This section gives the unauthenticated user access to the Default1.aspx page only. It is located in the same folder as this configuration file. -->
        <location path="default1.aspx">
        <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
        </system.web>
        </location>
<!-- This section gives the unauthenticated user access to all of the files that are stored in the Subdir1 folder.  -->
        <location path="subdir1">
        <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
        </system.web>
        </location>
</configuration>

Upvotes: 1

nunespascal
nunespascal

Reputation: 17724

You can use the location element in web.config to configure permissions for sections of your website

<configuration>
   <location path="srlv">
      <system.web>
         <authorization>
            <deny users="?" />
         </authorization>
      </system.web>
   </location>
</configuration>

This will deny access to anonymous users.

Upvotes: 1

Kami
Kami

Reputation: 19447

You need to create a web.config file in the target folder with the following contents.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
          <allow users="Usw"/>
          <deny users ="*,?" />
        </authorization>
    </system.web>
</configuration>

It simply says, to allow user Usw but deny everyone else.

Upvotes: 1

Related Questions