Block Access to URL in ASP.NET and C# in web.config file

Question

I am trying to block specific URL to all users in web.config file in my ASP.NET webforms, but it is not working. Note that my admin table is located in SQL Server ( admin_login_tbl ). I have tried below code in web.config file but all users/admin page is denied. Can you please look into this code what is the issue.

<location path="adminitemlist.aspx">
        <system.web>
            <authorization>
                <allow roles ="admin" />
                <deny users="*" />
            </authorization>
        </system.web>
</location>

Answer 1

what location is this web config file?

You cannot have more then one web.config file in the SAME folder. And that ALSO includes the root folder. (so, you can't just drop in a extra web config file, and expect/assume that BOTH.config files will be used - they will not!!

So, only ONE file.

As a general rule, if I have say a site admin page, and want to secure to a given group of users? (given group of Roles)

Then I will move all of the web pages to a sub folder, and drop in that web.config file.

Now, you CAN add such security to specific pages in the MAIN web config file if the page in question is ALSO in the root file.

However, since that web.config file is a HUGE mess and will have boatloads of config stuff and a gazillion other things?

Then you would DO VERY well to move such pages out into a folder.

But, you can specify such pages, and you have to include the path name to that sub folder.

Say like this in the main web.config file:

But, I VERY much tend to avoid the main web.config file for this purpose.

So, in above, I would add the web.config file to folder Test4 like this:

And thus the simple web.config file in that folder becomes this:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
       <allow roles ="admin" />
       <deny users="*" />
    </authorization>
  </system.web>
</configuration>

So, not only does above mean no hard coded path name, and you don't need one?

Well, if you copy, or move or change the location of such pages, then the above will continue to work.

So in summary: ONLY ONE.config file allowed per folder.

You CAN add and secure a folder in the main web.config file if you include the path name. But, I think one should VERY much leave that main config file alone - it always a huge hairy ball of a configuration anyway.