Question

I have one need: In an Asp.Net 4.0 application I would like to deny access to some resources. The goal I would like to reach is the following:

1) Consider a user trying to get a document from my application, for example a txt file located somewhere in my application.

2) When the user types the url of my web site and the resource, for example www.mysite.com/Folder1/myfile.txt my application should NOT give that file back.

How to do this???

Thankyou

Answer 1

You can use location tags to control this type of thing.

In this example, I give Customers and Admins access to the CustomersFolder directory:

<location path="CustomersFolder">
    <system.web>
        <authorization>
            <allow roles="Customers, Admin"/>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>

And with this second block, I then limit access to a certain file under that folder to just Admins:

<location path="CustomersFolder/SecureFile.aspx">
    <system.web>
        <authorization>
            <allow roles="Admin"/>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>

Hopefully something like that will work for you.