Re: can I set web.config to require authentication only for some files?

From: Steve C. Orr [MVP, MCSD] (Steve_at_Orr.net)
Date: 09/10/04 

Date: Thu, 9 Sep 2004 19:30:29 -0700

You can specify some pages to require login, and others to not require login
via your web.config file by using the <location> tag.

Here is an example with sample code that you can download and play with.
http://www.dotnetbips.com/displayarticle.aspx?id=117 

-- 
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
"Bennett Haselton" <bennett@peacefire.org> wrote in message 
news:e614455c.0409091740.137b1092@posting.google.com...
> If I add this to my web.config file:
>
> <authentication mode="Forms">
>    <forms name=".ASPXUSERDEMO" loginUrl="login.aspx" protection="All"
> timeout="60" />
> </authentication>
>
> I can configure the application so that users who try to access a page
> in the application, get redirected to login.aspx where they have to
> sign in.  (And the "signing in" is handled in the codebehind page of
> login.aspx.)
>
> What if I want to configure authentication so that it's only required
> for certain files?  Or only for certain directories?  Is there a way
> to specify in the <forms> tag or in the <authentication> tag that you
> want authentication to apply only to certain files or directories?  I
> couldn't find any documented way.
>
> If you create a subdirectory and put a web.config file in there with
> its own <authentication mode="Forms"> tag, in an attempt to make
> authentication apply only to files in that directory, then you get the
> ASP.Net error:
>
> It is an error to use a section registered as
> allowDefinition='MachineToApplication' beyond application level.
>
> As a last resort I could create a new project directory as a
> sub-directory under the top-level project directory, but that sounds
> inelegant; it'd be better to be able to manage all files in a single
> project.
>
> -Bennett

Relevant Pages

  • Re: Custom redirectURL
    ... he did specify that he wanted ... >>how do I supply this redirect without a Response.Redirect ... > use the same link and login page for both. ... >> In Forms based authentication mode, say my login page has to be ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Forcing both password and PublicKey Authentication
    ... password for authentication? ... authenticates it hands off to login for an interactive login session. ... Can you specify a login shell if you trust the ...
    (comp.security.ssh)
  • Forms Authentication: <location> authorization not bypasssing login page.
    ... I am trying to configure my forms authentication so a certain page is not ... subject to a redirect to the login page. ... simple thing to do with a tag, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Exclude pages from authentication!
    ... However there are a couple of pages that don't require authentication.. ... What do i need in my web.config, to specify these pages don't require ... thus the user is not redirected to my default login url..when they ...
    (microsoft.public.dotnet.framework.aspnet)
  • Trouble with forms authentication
    ... I am trying to password protect a subdirectory using forms authentication. ... am using the "Location" tag to specify the directory to be protected. ...
    (microsoft.public.dotnet.framework.aspnet)