Site Authentication Required, Except Default.aspx

February 12, 2010 | Comments | ASP.NET

What happens when you need to protect your whole site so that only Authenticated users can access our site.

Since I received this question twice this week I thought I’d share a tip.

To allow ONLY authenticated access to your site using Forms authentication you can add a section like this on e to your application’s web.config file.

<authentication mode="Forms">
<forms loginUrl="Login.aspx" name="Login" protection="All"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>

The problem is that it seems lots of folks don’t want users to automatically redirect to the Login.aspx page when they navigate to their site home page.

To require authentication for all the pages in your web application EXCEPT the home page (Default.aspx))

Also add a location section to your web.config file that explicitly allows anonymous users to access JUST the default.aspx page.

<location path="default.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>

You can use the web.config location element to specify folders as well as pages which makes it a very powerful construct.

Technorati Tags: Microsoft ASP.NET Security Tips & Tricks

Comments

There are 21 comments for this post.

subbaraokv on February 12, 2010 10:03 am

How do we achieve this if the website is using Windows Authentication not forms?
Site Authentication Required, Except Default.aspx : Misfit Geek on February 12, 2010 10:58 am

RE: Site Authentication Required, Except Default.aspx

Pingback from Site Authentication Required, Except Default.aspx : Misfit Geek
anthony on February 12, 2010 11:00 am

subbaraokv I don’t believe you can, since Windows Authentication is set for the whole application you cannot define single pages within that application to ignore it.

The workaround would be to create a new website in IIS that allows anonymous authentication to the root directory.

Then create a subdirectory and convert it to an application which you can enable Windows Authentication on.

Visitors hitting the homepage will be able to see it unauthenticated, but requests to the subdirectory will require windows authentication. Hope this helps.
Dave on February 12, 2010 11:57 am

If you want to do it with Windows Authentication then you could use roles

<authorization>

<allow roles="AnActiveDirectoryRole"/>

<deny users="*" />

</authorization>
rickj on February 12, 2010 1:38 pm

I had the same type of problem I just put all of the pages I wanted to protect in folders and set authorization in the web.config files and left the pages open to the public in the root

<configuration>

<appSettings/>

<system.web>

<authorization>

<allow roles="Administrators"/>

<deny users="*" />

</authorization>

</system.web>

</configuration>
krish on February 12, 2010 4:01 pm

I have one question ,what if I mention the users name in the

<deny users="xyz" />

My login name is xyz

What will happen?
Joe Stagner on February 12, 2010 4:03 pm

<DENY
krish on February 12, 2010 4:05 pm

when I add xyz in the <deny users="xyz" ?>

its letting me to login to the page….
BostLabs on February 12, 2010 4:55 pm

krish,

I setup several web sites in our enterprise and I always had to include the domain name for allow/deny.

Example: <allow users="domain\xyz"/>

Not sure if you would need the machine (computer) name if you are just using a stand alone server.
BostLabs on February 12, 2010 4:56 pm

BTW Joe, Thanks for the Tip. I hadn’t thought about the location path for doing that. I always made sub directories
Joe Stagner on February 12, 2010 5:00 pm

Yea, I always used sub directorys for protected areas and hadn’t about it untill people emailed me and asked.
spongebob on February 12, 2010 10:02 pm

so if I want to make my site members I can use forms excellent cool info thanks for the tip
abhi-viking on February 13, 2010 12:35 am

Hi Joe, nice tip ! Thanks
LukCAD on February 13, 2010 4:27 am

Nice to hear smart people, Hi Joe, I am back to read all again!

Sincerely, LukCAD
Venkatesh on February 13, 2010 5:37 am

Hi, I have created 2 subfolder and I need to give permission to 2 different roles. I have writen like this:

<location path="Member">

<system.web>

<authorization>

<deny users="?"/>

<allow roles="Member"/>

</authorization>

</system.web>

</location>

<location path="Admin">

<system.web>

<authorization>

<deny users="?"/>

<allow roles="Admin"/>

</authorization>

</system.web>

</location>

But this allows boths the roles to both the folder resources.

May i know how fix this?
Chimera Studios web design on February 13, 2010 11:04 am

Great stuff Joe!
Ahsan Murshed on February 14, 2010 3:44 am

simple but important tips.

thanks joe.
Ylang Duongnt on February 14, 2010 8:56 pm

Thanks you!

This is sample, someone who is web dev should knowledge

(^..^)
0xc0000005 on February 18, 2010 11:54 am

Thanks for user authentication tips. I’m new to aspx, I’m much grateful for any helpful info.
Oyunlar on February 21, 2010 1:05 pm

Hi Joe, nice tip ! Thanks
STB on February 22, 2010 11:33 am

Good tips! Thank you, Joe.

Write a Comment

Let me know what you think?

Misfit Geek