Question

In ~/tools/ I have a webconfig file that contains the following:

 <system.web>
    <authorization>
      <allow roles="admin" />
      <deny users="*" />
    </authorization>
  </system.web>

Requests to ~/tools/mypage.aspx require the user to be in the admin role. If I use URL routing and have requests to ~/categories/mytools route to that above page, forms authentication does not require the user to be in the admin role. How do I use forms authentication on a virtual routed url?

---

So I need to add this to my webconfig:

for every virtual url that needs forms authentication? Seems repetitive if this has to be done with every url that is directed to a ‘protected’ destination page. Is there another solution?

Answer 1

Since ~/categories/mytools is not explicitly ~/tools the web.config authorization does not get called. Even with virtual routing. You will need to replicate the web.config files across the directories to achieve this affect. To avoid doing double duty, you might want to put these entries into the root web.config listing their specific directories or files for exact permissions.