How to limit access to admin subfolder using web.config file?

From: Frenny Thomas via .NET 247 (anonymous_at_dotnet247.com)
Date: 08/28/04 

Date: Sat, 28 Aug 2004 05:50:35 -0700

I'm in quite of a dilemma, and for the first time: all the articles and discussion forums on the 'net hasn't helped me get rid of my page errors :(

I have my web.config file in the root directory. I have a subdirectory called /admin/ underneath it. I want all users to be able to view any page in the root directory. If a user tries to access any page in the /admin/ subfolder, I want him/her to be redirected to a login page (located in the subfolder itself).

I have tried two methods of doing the job, but neither have worked. Can anyone give me any suggestions/explanations??

Method 1
--------------------------------------------------------------------------------
<configuration>
   <system.web>
       <customErrors mode="Off"/>
       <compilation debug="true"/>
       <authorization>
         <allow users="*"/>
       </authorization>
   </system.web>

  <location path="admin">
   <system.web>
       <customErrors mode="Off"/>
       <compilation debug="true"/>
       <authentication mode="Forms">
              <forms name="frmLogin"
                loginUrl="login.aspx">
                </forms>
       </authentication>
       <authorization>
            <deny users ="?" />
       </authorization>
   </system.web>

   </location>
 
</configuration>

Method 2 [After I moved the login.aspx page back up to the root directory]
--------------------------------------------------------------------------------
<configuration>
        <system.web>
                <customErrors mode="Off" />
                <compilation debug="true" />
                <authentication mode="Forms">
                        <forms name="frmLogin"
                         path="/"
                         loginUrl="login.aspx"
                         protection="All"
                         timeout="20"></forms>
                </authentication>
                <authorization>
                        <allow users="*" />
                </authorization>
        </system.web>
        <location path="admin">
                <system.web>
                        <authorization>
                                <deny users="?" />
                        </authorization>
                </system.web>
        </location>
</configuration>

-----------------------
Posted by a user from .NET 247 (http://www.dotnet247.com/)

<Id>xHCHhTG8eE+6XecD+Q5rHQ==</Id>

Relevant Pages