authorization web.config

Question

I am restricting access to the Account folder using below:

<location path="Account">
  <system.web>
    <authorization>
      <deny users="?"/>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

and access to the Default.aspx using

<location path="Default.aspx">
  <system.web>
    <authorization>
      <deny users="?"/>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

but how do I restrict access to a specific file in the Account folder rather than the entire folder?

I tried the following but did not work

<location path="Account\ChangePassword.aspx">
  <system.web>
    <authorization>
      <deny users="?"/>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

Answer 1

Try this

<location path="Account/ChangePassword.aspx">
  <system.web>
    <authorization> 
      <deny users="?"/>
    </authorization> 
  </system.web> 
</location>