Under the root directory I have the following structure
..
..
..
web.config
Report Folder
- Login.aspx
- Web.config
|
|-> ViewReport
|
|-> Report.aspx
In my web.config file in the Report folder I have the following:
<?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="ViewReport/Report.aspx">
<credentials passwordFormat="Clear">
<user name="Johl" password="pass888"/>
</credentials>
</forms>
</authentication>
</system.web>
<location path="ViewReport/Report.aspx">
<system.web>
<authorization>
<allow users="Johl"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
</configuration>
When I start debugging I get the following message:
It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.
NOTE that in my root web.config I have something like the following:
In my root, I already have the following:
<system.web>
<authentication mode="Forms">
<forms loginUrl="Str/StrUserLogin.aspx" timeout="2880" slidingExpiration="true" />
</authentication>
<authorization>
<allow users="*" />
</authorization>
</system.web>
Create a virtual directory at the site root. This can be done via project properties in VS under the Web tab.
It's also possible that you have things defined in the sub-directory that should be in the root config file. See similar question here:
Error to use a section registered as allowDefinition='MachineToApplication' beyond application level
Converting your folder/project into an application in IIS can resolved this error.
This error seems to occur if you try to open an asp.net WEBSITE and run it while it was originally encapsulated by a SOLUTION.
Do this: Close the website, find the related solution (.sln-file) further up in the file system and open this in stead. Inside the solution you will now be able to use your website without getting this error.
It would be nice if Microsoft could guide people in the right direction when they get lost in asp.net like this. The present error message about allowDefinition=MachineToApplication is not understandable for normal humans like me.
If you put the published files in inetpub/wwwroot/../ Make sure to add the root folder as an application in IIS Manager.
The contents of the web.config in the subdirectory should be placede in the root directory. The configuration in the subdirectory is making IIS treat the subdirectory as the application root but it is not the application root. This is why you get the error allowDefinition='MachineToApplication'.
I deleted my bin and obj folder for the project and then rebuilt the solution and everything was working fine...not a technically savvy answer but it works.
Just add this below lines in your csproject file to clean up the obj/bin folder automatically.
<Target Name="BeforeBuild">
<!-- Remove obj folder -->
<RemoveDir Directories="$(BaseIntermediateOutputPath)" />
<!-- Remove bin folder -->
<RemoveDir Directories="$(BaseOutputPath)" />
</Target>
I opened the web site from IIS instead of file system and it worked.
In my case, my website was working before deploying the new version.
I found an incorrect Web.config inside Views folder. I replaced it with original file and the problem resolved.
This error occur if your web.config file and your all aspx file are not in the same folder. so please put all the files in the same folder.
Thanks.
Related
I have an ASP.NET MVC website. There is a "booklist.csv" file in the "~/booklist" folder, which is not supposed to be served to the public.
To prevent the public from downloading this file using
www.mywebsite.com/booklist/booklist.csv
I have the following web.config file in the "~/booklist" folder:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
I have also the following in the root web.config:
<modules runAllManagedModulesForAllRequests="true">
On our test server, it works, and public cannot download that "booklist.csv" file. But on our production server, it doesn't work. Public can still directly download that CSV file.
What could be the problem?
I worked out. The production server was actually behaving as expected, the same as the testing server. It was my browser caching that CSV file. So my settings were correct.
I have this in the web.config
<location path="SomeDir/SomeSubDir">
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>
How do I change this so that this rule only applies when the app is not running on localhost? Is there a way to make the rule detect the environment?
I would remove the deny from the web.config and use something like this in the page load event.
if(!HttpContext.Current.Request.IsLocal && !User.Identity.IsAuthenticated)
Response.Redirect("Login.aspx");
Config Transformations will give you a Web.Release.config that will transform your Web.Config when you publish with the Release settings.
If you don't already have the transform files, you will need to right-click the Web.config file and then click Add Config Transforms.
Here is the MSDN How to: Transform Web.config When Deploying a Web Application Project.
Your Web.Release.config file would look something like this:
<configuration xmlns:xdt="...">
<location xdt:Locator="Match(path)" xdt:Transform="Remove" />
</configuration>
Which will result in that location element being removed when you do a Release publish.
My web config, which is a config file in a folder (a config file additional to the main config file in the virtual directory):
> <?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms name=".MyCookie" loginUrl="~/Registration.aspx" protection="All" timeout="43200" path="/">
<credentials passwordFormat="MD5">
<user name="user" password="ca064d0730abfeb09e383a0e82e65f73"/>
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?"/>
<allow roles="Moderator"/>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
The error that I get:
Error 3 It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS. 5
I am trying to redirect any anonymous users from the administrator and moderator directories.. so I want any anonymous user or users with no role to be redirected to register.aspx..but i dont get it to work because I get that error and I dont know why!! :(
the authentication tag is not permited on subdirectories web.config, unless you define this subdirectory as a full asp.net application, means a diferent aplication than the root - I not suggest it.
so remove this, and keep it to the root web.config only.
<authentication mode="Forms">... </authentication>
You should define your sub directory as location in your web.config.
Check location element. Also check this scenario.
This article explains how to organize your web.configs and location elements.
This is because the section is only supported in IIS
application directories, which doesn't include subdirectories of an
IIS application.
I have the authentication which will redirect the unregister user to Login.aspx. At the bottom of the page,there are a link button will redirect the user to forgotPassword.aspx
With having the authentication, i discover it don't allow the unregister user to go forgotPassword.aspx but staying in the same page.
so some expert have shown me this code..
can anyone provide me the code in web.config here?
some expert have provided me the code..but i find no where to locate this code in web.config, none of them tell me where to locate it..click this link ..im abit confused.. please provide me whole web.config code so i can have overall idea :( thankss
You need to put it between the main configuration elements:
<configuration>
<!--You have other configuration elements here-->
<location path="passwordrecovery.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
</configuration>
Just don't forget to accept an answer from your original question.
UPDATE
It is important to note that the above assumes that the passwordrecovery.aspx file is located in the same location as the web.config file that contains that above configuration. If the passwordrecovery.aspx file is located somewhere else, you will need to change the path attribute.
So, assuming the web.config is in the root of your site, and the passwordrecovery.aspx file is in the folder /Presentation/Display then you will need to update the code as follows:
<configuration>
<!--You have other configuration elements here-->
<location path="Presentation/Display/passwordrecovery.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
</configuration>
Another alternative is to keep the original configuration provided, but create it in a new web.config file that is located in the same folder as the passwordreovery.aspx file.
Context:
IIS 6 on Windows 2003 Server
ASP.NET 3.5 sp1
C# Web Application running from a virtual directory
There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
OR
<httpHandlers>
...
<add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>
The logs in a different directory can be protected through another Web.config file:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:
<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />
How do I make IIS 6 respect the authorization rules in Web.config.
Note: assume that I can't move these files outside of the deployment directory.
It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.
To work around this, I had to do the following (from this forum post):
From IIS Console, open properties of the virtual directory of my app.
Virtual Directory > Configuration
Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
All verbs. Uncheck both "Script engine" and "Verify that file exists".
Is there any way to do this from within Web.config?
Try this:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.
To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:
1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)
2) in web.config add the location for the restricted directory or file
<location path="directory_or_file_name">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
3) Add the following to the httpHandlers section:
<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />
This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.
URL Authorization: The URLAuthorizationModule class is
responsible for URL authorization on
Windows 2003. This mechanism uses the
URL namespace to store user details
and access roles. The URL
authorization is available for use at
any time. You store authorization
information in a special XML file in a
directory. The file contains tags to
allow or deny access to the directory
for specific users or groups. Unless
specified, the tags also apply to
subdirectories.
You need to do the following:
<deny users="?"/>
<deny users="*"/>
The wild card entry "?" means that no one else will be able to gain access to this directory.