steve cook
Reputation: 3224
ASP.NET authorisation allow "*" vs "?"
If I set an all-users authorization rule e.g. <allow users="*"/> does this also allow anonymous users (ie. ones that haven't logged in) to see the resource?
How about vice-versa - if I allow anonymous users with "?" can all logged in users also see it?
Upvotes: 1
Views: 212
Answers (1)
juhan_h
Reputation: 4021
- Yes -
*means absolutely anybody. - Yes -
?means anonymous users from which all users "inherit".
Difference is mentioned in ASP.NET Authorization article.
Upvotes: 2
Related Questions
- How to use authorization by default without [Authorize] in ASP.NET Core 5
- What is the default policy for AuthorizeFilter?
- Why is <deny users="?" /> included in the following example?
- Difference between authentication and authorization filters in aspnet-mvc5
- .NET Authorization. Does the order or allow and deny elements matter?
- What does Authorize(Users="*") mean?
- <authorization> tag in ASP.net
- What does [Authorize(Users = "*")] mean in asp.net mvc
- ASP.NET Authorization what does the * and ? mean?
- Using ASP.NET login controls wih deny="?"