web.config authorization deny unauthorised

Question

I am developing a .NET for ASP.NET Web Application and am trying to deny all users who are unauthorised from accessing my application but allowing them only to the login page.

Below is a snippet of the code which is inside my system.web section:

<authentication mode="Forms">
   <forms loginUrl="Login.aspx" timeout="60" name="APPNAME" slidingExpiration="true" />
</authentication>
<authorization>
   <deny users="?" />
</authorization>

I also have this outside to allow access to the login page:

  <location path="Login.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

However I am still able to access pages when I am not logged in, how could I stop this from happening?

I have even added a Web.Config file to the Main folder which stores most of the website files which the contents of is:

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

But this is still not having any effect.

Solution

I had followed some optimisation tips for asp.net (http://www.codeproject.com/KB/aspnet/10ASPNetPerformance.aspx) and removed the AnonymousIdentification httpModule which I actually needed.

Answer 1

Try adding LoginStatus control to your page to check your login status.

You might have checked 'Saved password' option previously. Check and clear your cached password using control userpassword2 command.

Answer 2

You can put a new Web.config in the folder that needs the permissions applied. Inside it do something like this

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

Or you might need to wrap the <authorization> tag with a <security> tag.

Answer 3

I think what you will find is that it is far easier to deal with ASP.NET authorization if you put different web pages with different intended roles in different folders. That's not a requirement. It's just easier to manage.

If you are in VS 2010 (I'm not sure this is in the express edition) try using the ASP.NET Configuration tool at the bottom of the Project menu.

I found that it was easy to learn how the web.config files worked by using that tool at first, making some changes to security, and then going and looking at what it did.

If you just start with a blank ASP.NET application in VS 2010, you can lock out everything but the login and register page by making two changes:

In the root web.config

 <system.web>
    <authorization>
      <deny users="?" />
    </authorization>

In the web.config in the Account subfolder

<?xml version="1.0"?>
<configuration>

  <location path="Register.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

  <system.web>
    <authorization>
      <allow users="?" />
    </authorization>
  </system.web>

</configuration>

What you'll see is that the user is immediately directed to the login page, but they can still register.