CODEWITHSUNDEEP
c#.netweb-services
Storm
Storm

Reputation: 3252

Preventing getting to other URL of web service

I am doing a web service in .NET containing a server file (.asmx) and a client interface (.aspx). The visitors should be able to visit only the client aspx site ( urlXXX:portYY/Client.aspx) However, when I remove the "/Client.aspx" part from the URL, I get into the project directory and this should not be possible. (So far, I am running the project just on localhost.)

Is there any way, how restrict getting into other parts of the solution? The only possibility I could think of is creating a separate project for the client aspx site, however, even then the visitor is able to get into the directory containing that site.

Upvotes: 0

Views: 125

Answers (2)

Storm
Storm

Reputation: 3252

So, basically I have managed to find a workaround, by adding the following code into the Web.config:

<system.webServer>
    <defaultDocument>
        <files>
            <add value="Client.aspx" />
        </files>
     </defaultDocument>
</system.webServer>

...which makes the Client a default web-page, thus preventing to see the directory. However, I will leave this topic open in case someone comes with a more elaborate and sophisticated solution.

Upvotes: 0

Nick
Nick

Reputation: 2325

You should be able to control explicit access using your web.config. Have a look at this example (exclaimer: I've copied this straight from this MS page):

<configuration>
    <system.web>
        <authentication mode="Forms" >
            <forms loginUrl="login.aspx" name=".ASPNETAUTH" protection="None" path="/" timeout="20" >
            </forms>
        </authentication>
<!-- This section denies access to all files in this application except for those that you have not explicitly specified by using another setting. -->
        <authorization>
            <deny users="?" /> 
        </authorization>
    </system.web>
<!-- This section gives the unauthenticated user access to the Default1.aspx page only. It is located in the same folder as this configuration file. -->
        <location path="default1.aspx">
        <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
        </system.web>
        </location>
<!-- This section gives the unauthenticated user access to all of the files that are stored in the Subdir1 folder.  -->
        <location path="subdir1">
        <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
        </system.web>
        </location>
</configuration>

EDIT: Take a look at this question for more info on denying access to explicit folders as well.

Upvotes: 1

Related Questions