Protecting site content

From: James (anonymous_at_discussions.microsoft.com)
Date: 05/07/04 

Date: Thu, 6 May 2004 17:46:02 -0700

I am using ASP.NET authentication and authorization to protect content in certian portions of a site. Through web.config and other means, I define user roles to access certain directories.

I also want this protection applied to static content (such as html and images). Originally this did not work b/c IIS was not doing a check with ASP.NET when retrieving such content. I updated the Action Mappings for these file extensions so that they were associated with the ASP.NET ISAPI DLL.

It works except for one thing.

The check is not performed when a default document is returned. Meaning, if I go to http://localhost/protected/ my browser displays default.htm (when it should redirect me to login). However, if I go to http://localhost/protected/default.htm I get redirected.

It's obvious that the check is not occuring b/c there is no extension mapping. Can I configure IIS to verify with .NET even if the GET was not for a particular document, but just a directory?

Relevant Pages

  • Re: Use login control to limit access to certain pages
    ... // Allows unrestricted access to the folder named anonymousAccess ... authorized users, not to all public site visitors. ... don't need to protect at all. ...
    (microsoft.public.dotnet.general)
  • Forms Security Problem
    ... I have a site I am trying to protect using forms based security ... I then copied my web.conf file to a subfolder, and changed it so that the ...
    (microsoft.public.dotnet.framework.aspnet)
  • Cant protect my .ASCX usercontrols placed in subdir
    ... XmlDagbok <- Application root, open to everyone ... My whole app is built by using usercontrols contained in one page, ... really would like to protect the usercontrols from being read by someone not ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Has anyone written authentication for Araneida?
    ... and protect a directory or set of files from unauthorized access. ... AUTHENTICATE-REQUEST and AUTHORIZE-REQUEST, for doing ... authentication and authorization. ...
    (comp.lang.lisp)
  • Need to create in-memory store for authorization roles
    ... authorization. ... I know I can go get the roles from the database and add them ... know that at the point where I need this the session state bag is not yet ... Any thoughts on how best to create an in-memory store for user roles? ...
    (microsoft.public.dotnet.framework.aspnet)