CODEWITHSUNDEEP
asp.netauthenticationconfigurationwebforms
Digbyswift
Digbyswift

Reputation: 10400

How can I deny anonymous access to a path at runtime

I have a multi-language .Net 4 webforms site (www.example.com/en/, www.example.com/fr/ etc.) and each language has a member area, e.g. www.example.com/en/members/ and www.example.com/fr/members/

A CMS (Umbraco) has control over language branches and content, and therefore has control over adding or removing them. This means that I cannot use the <location> sections in the root web.config to deny anonymous access to each members branch as they may be published after the application has started.

Is there any way to add a ConfigurationLocation section to the Locations property of a System.Configuration.Configuration instance after an application has started, without restarting the application? Alternatively, is there a more flexible way to control path access at runtime?

Upvotes: 0

Views: 222

Answers (2)

Digbyswift
Digbyswift

Reputation: 10400

The solution I used was to create a HttpModule. But with a HttpModule in umbraco, you can not easily retrieve the currentNodeId as this is added as part of a different process.

The module carried out the following checks on the PostAuthenticateRequest event:

  1. Is the requested path a reserved path in umbraco?
  2. Is the user authenticated already?

If these two both returned false

  1. Using the request domain, I retrieved the root node id by finding the node with the matching asscociated domain;
  2. I then created a xpath query using the parts of the requested path but that existed underneath the node with the id retrieved above. This query gave me the current node;
  3. I then checked whether the current node existed as a descendant of a node flagged as requiring authentication.

Upvotes: 0

Icarus
Icarus

Reputation: 63956

Alternatively, is there a more flexible way to control path access at runtime?

You can extend all secure pages from a BasePage that has something like this inside the Page_Load event

if(!HttpContext.Current.User.Identity.IsAuthenticated)
   Response.Redirect("Login.aspx");

Update

If you don't know which pages are going to be secured, change my code above to read the pages that need to be secured from a database table and compare the current page name with the ones contained in the list from the table. You can catch the list and automatically expire the cache every 20 min, for example. At least you'd be able to flag a page as Secure w/o restarting the app while maintaining some flexibility as far as not needing to know in advance which ones should be secure.

Upvotes: 1

Related Questions