ASP.NET Web窗体-Web窗体的安全性

Question

simple but hard to solve question on Web Forms.

I enforced a role-based access on my web form application, but I would like to tailor the access based on WebForm or URL, something like

/Administration/* --> only admins /Users/* --> admins and users /* --> anonymous also

Any hint on how to do it on web.config?

Thank you and best regards

Answer 1

<location path=”Admin”>
                <authorization>
                                <allow roles=”Admin” /> 
                                <deny users=”*” />
                <deny roles=”*” /> 
                </authorization>
</location>

or take a look here: http://support.microsoft.com/kb/316871 or http://weblogs.asp.net/gurusarkar/archive/2008/09/29/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config.aspx

Answer 2

An easiest way would be to create local web.config files in each of your subfolders. Such local web.config would only contain the authorization information so that the built-in UriAuthorizationModule could do the rest for you.

For example, inside the /Admin folder create a web.config with

<configuration>
 <system.web>
 <authorization>
   <allow roles="Admin" />
   <deny users="*" />
 </authorization>
 </system.web>
</configuration>

thus giving the access to only users who are administrators. Apply the same to other subfolders and you are done - under a condition that a role manager exists and provides the information about users' roles.

Creating local web.config s containing only the authorization data in each subfolder gives you fine-grained control over your authorization. The alternative would be to provide this information in the main web.config but it would soon become overloaded with many authorization nodes referring to different locations.