Question

Is there a way to web protect ASP.NET website so it asks user for username/password to view?

I’ve been told that this should go in web.config file, but not sure of how to do this, or what should go in there. Any help much appreciated.

Answer 1

If it is an intranet scenario it’s quite simple. Add this in your web.config

<configuration>
<system.web>
<authentication mode=”Windows”  />
 <authorization>
 <deny users="?"/>
 </authorization>
</system.web>
</configuration>

Fastest way for internet applications:

<authentication mode="Forms"> 
   <forms loginUrl="~/login.aspx"> 
    <credentials> 
     <user name="user" password="password" /> 
     <user name="user2" password="password2" /> 
    </credentials> 
   </forms> 
  </authentication> 

  <authorization> 
    <deny users="?"/> 
  </authorization> 

You will also need a new page login.aspx with a form where the user can enter his credentials. On the code behind page you then need the following code:

string username = textBoxUsername.Text; 
string password = textBoxPassword.Text; 

if (FormsAuthentication.Authenticate(username, password)) 
    FormsAuthentication.RedirectFromLoginPage(username, false);