Question

The URL for the administration section of my website always starts with Admin/. Is it possible in ASP.NET MVC to restrict access to users by using this part of the URL?

Obviously I would keep the [Authorize(Roles = "Administrator")] on appropriate controllers and actions but I wonder if it would be quicker for the application if it can just look at the URL instead of stepping into code.

Answer 1

Found the answer in Steven Sanderson’s book, Pro ASP.NET MVC Framework.

Put the following code in your web.config file.

<location path ="Admin">
  <system.web>
    <authorization>
      <deny users="?"/>
      <allow roles="Administrator"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

This means for any URL matching ~/Admin/*, the application will deny access to unauthenticated visitors or
any other visitors other than those with the role ‘Administrator’.