Access control?

[Olav Tollefsen]

I have the following in the Web.config file (root directory):

<authentication mode="Forms">
<forms name="Login"
loginUrl="Login.aspx"
protection="All"
timeout="60"
path="/" />
</authentication>
....
<authorization>
<deny users="?" />
</authorization>
....
<location path="LostPassword.aspx">
<system.web>
<authorization>
<allow users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>

My question:

How does this affect access to files in other directories like the
Images folder? Does the above control access to images file types at all
or does it only protect execution of .aspx files?

Olav

[Ken Cox [Microsoft MVP]]

Hi Olav,

If you wanted to handle Images folder as a special case, you would provide
only the folder name, without the page name:

<location path="Images">
"Olav Tollefsen" <[e-mail]> wrote in message
news:%2****************@TK2MSFTNGP09.phx.gbl...

I have the following in the Web.config file (root directory):

<authentication mode="Forms">
<forms name="Login"
loginUrl="Login.aspx"
protection="All"
timeout="60"
path="/" />
</authentication>
...
<authorization>
<deny users="?" />
</authorization>
...
<location path="LostPassword.aspx">
<system.web>
<authorization>
<allow users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>

My question:

How does this affect access to files in other directories like the Images
folder? Does the above control access to images file types at all or does
it only protect execution of .aspx files?

Olav

[Scott Allen]

Hi Olav:

ASP.NET will only control access to file types mapped to the
aspnet_isapi.dll in the script mappings for the application. For
example: aspx and ascx are access controlled, .jpg and .png are not.

HTH,

--
Scott
http://www.OdeToCode.com

On Mon, 05 Jul 2004 11:04:04 +0200, Olav Tollefsen <[e-mail]> wrote:

I have the following in the Web.config file (root directory):

<authentication mode="Forms">
<forms name="Login"
loginUrl="Login.aspx"
protection="All"
timeout="60"
path="/" />
</authentication>
...
<authorization>
<deny users="?" />
</authorization>
...
<location path="LostPassword.aspx">
<system.web>
<authorization>
<allow users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>

My question:

How does this affect access to files in other directories like the
Images folder? Does the above control access to images file types at all
or does it only protect execution of .aspx files?

Olav