Blocking Direct URL Access through web config

I have a web application using custom authentication and role
management, which seems to work properly. I also have a web config
file with the following:

<location path="systems">
<system.web>
<authorization>
<allow roles="Administrator,Reader" />
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="applications">
<system.web>
<authorization>
<allow roles="Administrator,Reader" />
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="certification">
<system.web>
<authorization>
<allow roles="Administrator,Reader" />
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="admin">
<system.web>
<authorization>
<allow roles="Administrator" />
<deny users="*" />
</authorization>
</system.web>
</location>

When I run the application, everything works fine. Clicking on my
menu links, I cannot access the pages for which I'm not assigned to an
allowed role. The problem is when I paste the direct URL into the
browser, I'm still able to pull up the pages I'm not supposed to have
access to. For example, when I log in as a reader (which I've
verified the role), I can click on the "Admin" link from the menu and
I get an "Access Denied" 401.2 error. However, when I copy the URL to
the browser, I can gain access to that page.

Anyone have any ideas? Any help is appreciated. Thank you.
.

Relevant Pages

  • Re: authentication mode for specific files?
    ... the web config. ... I have an img tag to an image in ... config file to specify specific files that do not require ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Need help with denying access to a folder...
    ... In my web config I have this: ... the forum software that I am using is the old asp so ... Only the Best Freeware at http://www.vbmark.com ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Blocking Direct URL Access through web config
    ... I also have a web config ... The problem is when I paste the direct URL into the ... the browser, I can gain access to that page. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: web.config in subfolder
    ... Modify your web config like this below. ... This will allwo Anon users into your wesite. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Basic Authorization Security Issue?
    ... seems like closing the browser ... When an non-authorized URL request in our intranet web server is attempted, ... resent with the basic authorization credentials and the user is logged in. ...
    (microsoft.public.security)
Loading