ASP.Net Roles: Page-Level Security Question

Question

We're currently in the process of re-creating a brand new security model that dwarfs our existing process. Right now, we plan on grabbing a user's roles during the login process and then using a Base Page class to check if the user has the role of the corresponding page the user is navigating to.

We can limit the menu's options by the user's roles as well, but we have had problems with users navigating to pages in our system by typing them in or having old bookmarks. Obviously, we need some sort of page level access.

A simple function in our Base Page class that checks the role in the Arraylist against the page's assigned role would work, but I was wondering if there was any built-in functionality to support this or a cleaner solution possibly.

Answer 1

Are you using built-in membership?

If so, you can use the location section of your web.config file to restrict access to individual pages or entire directories. From MSDN:

The following example allows an anonymous user to access the Logon.aspx page:

<configuration>
   <location path="Logon.aspx">
      <system.web>
         <authorization>
            <allow users="?"/>
         </authorization>
      </system.web>
   </location>
</configuration>

Answer 2

Have you looked at ASP.Net Membership for this yet? It takes care of all of the scenarios you listed above (trimming menus, page security,) and in a very easy to use manner.

See here for more information about membership - http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx.