CODEWITHSUNDEEP
asp.net-mvcweb-config
Tim
Tim

Reputation: 1309

configuration of folders and files in web.config

im trying to deny access to files and folders for anonymous users via webconfig for the application folder "/" and allow access to special controller paths ("Shared", "Verfolgung").

The configuration for the path "Shared" works but the access to "Verfolgung" requieres a authentification.

Maybe you tell me whats wrong?

Regards, float

part of web.config:

<authentication mode="Forms">
   <forms loginUrl="~/Account/LogOn" path="/" protection="All" timeout="2880" />
</authentication> 
<location path="Verfolgung">
    <system.web>
        <authorization>
            <allow users="*" />
        </authorization>
    </system.web>
</location>    
<location path="Shared">
    <system.web>
        <authorization>
            <allow users="*" />
        </authorization>
    </system.web>
</location>

Upvotes: 0

Views: 2744

Answers (2)

Rebecca
Rebecca

Reputation: 14422

In ASP.NET MVC you should not use the location element in the web.config. Whereas the web forms engine mapped to physical files on disk, the MVC engine using routing. This means that you could inadvertently allow access to a "protected controller" through a custom route by accident.

The recommended way of securing ASP.NET MVC applications is through the use of the Authorize attribute, as seen in the example below: 

public class HomeController : Controller
{
    [Authorize]
    public ActionResult Index()
    { 
        return View();
    }
}

The controller action is what you want to protect and not the route. The ASP.NET MVC Security bod, Levi Broderick is rather vocal about this issue:

  1. Excluding an action from authorization in ASP.NET MVC 2
  2. Problem with Authorization with IIS and MVC.

Upvotes: 5

Furqan Hameedi
Furqan Hameedi

Reputation: 4400

Try this, 

       <location path="Verfolgung">
           <system.web>
               <authorization>
                   <deny users="?"/>
                   <allow users="*" />
               </authorization>
          </system.web>
       </location>

Upvotes: 1

Related Questions