使用ASP.NET Web表单通过自定义登录阻止对文件夹的访问

Question

I have used asp.net membership for some time, but this time due to certain requirement we cant use asp.net membership. So i have to implement a simple login system where we have to validate uses and give them access to website section and on other side also block access to certain folder also so that logged in users can only access contents of these folders.

block access to following folders

/English/

/French/

/Images/

User should be able to access contents of these folders only if they are logged in. I am setting a simple session variable when user logs in successfully. Let us session["UserLoggedIn"] = true .

With asp.net membership we can block access to folders from web.config. But i am not sure how i can do it with custom loggin.

Any pointer in this regarding would be help full.

Answer 1

I'm not too sure if this will work for you, but I have done something similar to this in the past (see user Isaac's answer for a bit of guidance): Securing a web folder with out membership roles defined

Basically, upon the login event you could assign the session a variable of "English" or "French" (note I'm not in VS right now so my code might be roughly what you're looking for):

void protected OnLogin()
{
    if(UserIsAuthenticated)
    {
        Session["English"] = true;
    }
}

and then in the Global.asax file you should be able to reference that variable if the user is authenticated:

void Application_BeginRequest(object sender, EventArgs e)
{
    if(Request.PhysicalPath.Contains("English")
    {
         if(!((bool)Session["English"]))
             //Not "English" user - redirect to login or unauthorized page
    }
}

Again, my code is mostly taken from the link I gave you, if that doesn't work I can fish around some of my projects to see exactly what I've done in the past.

Additionally you could use Visual Studio 2012 and use the ASP.NET Web Configuration Tool and try to work your user database into working with it, I've seen people do it - it is a bit complicated because you have to code a bit in the web.config file, but is more likely secure I am guessing. This MSDN article might help some as well: http://www.asp.net/web-api/overview/security/external-authentication-services .