Allow only anonymous users via web.config authorization - asp.net

I want to use authorization in the web.config to block access to SignUp.aspx to authenticated users. It cannot be accessed by user such as their roles is administrator and Guest.
<location path="SignUp.aspx">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<authentication mode="Forms">
<forms name="AuthCookie" loginUrl="Login.aspx" timeout="60"
defaultUrl="Index.aspx"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>


<authorization>
<allow users="?"/>
<deny users="*"/>
</authorization>
Can't actually validate it now but it should do the trick. The explicit denial of all other users should allow only unauthenticated users allow the page.

Related

How can i exclude my register page from Form Authentication Redirect to login page

as the title says, i am trying to exclude a few pages such as my register.aspx from Form Authentication Redirection, here is my web.config
<authentication mode="Forms">
<forms name="MyAppCookie" loginUrl="Login.aspx" protection="All" timeout="120" defaultUrl="Default.aspx"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>

Use the location tag in your web.config.
<location path="register.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
See this article for more information.

Problems Creating correct location element in web.config for asp.net site

I have a test site on the web that I want to block all annoymous access to except logged in users. I also want to have annoymous access to just my login page (account/login)
I don't know how to exclude one path but even the below does not work, forgetting about the path.
<location path="">
<system.web>
<authorization>
<deny users="*" />
<allow users="?" />
</authorization>
</system.web>
</location>

Ideally, the following web.config setting should work. Make sure you update two Login.aspx with your login page.
It basically does not allow anonymous access except Login page.
<configuration>
<system.web>
...
<authentication mode="Forms">
<forms loginUrl="~/Login.aspx" />
</authentication>
<authorization>
<deny users="?"/>
<allow users="*" />
</authorization>
</system.web>
<location path="~/Login.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
</configuration>

Allow user access controller in asp mvc

I use authencation in asp.net mvc4
<authentication mode="Forms">
<forms loginUrl="~/Login" timeout="2880" />
</authentication>
when I'm not logged in, can not call functions registered in RegisterController. I try
<location path="~/Register">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
but is not.
How to solve?

<location path="Register">
<system.web>
<authorization>
<allow roles="roles if any" />
<deny users="*" />
</authorization>
</system.web>
</location>
try this this may work .. change the role if u got any that need access!!

Allow access for unathenticated users to specific page using ASP.Net Forms Authentication

I am using ASP.Net Forms Authentication. My Web.config looks like this.
<authentication mode="Forms">
<forms loginUrl="login.aspx"/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
So currently every aspx page requires authentication.
I want to allow access to even unauthenticated users to a specific page named special.aspx.
How can I do this?

Take a look at the example on MS Support
<configuration>
<system.web>
<authentication mode="Forms" >
<forms loginUrl="login.aspx" name=".ASPNETAUTH" protection="None" path="/" timeout="20" >
</forms>
</authentication>
<!-- This section denies access to all files in this
application except for those that you have not explicitly
specified by using another setting. -->
<authorization>
<deny users="?" />
</authorization>
</system.web>
<!-- This section gives the unauthenticated
user access to the ThePageThatUnauthenticatedUsersCanVisit.aspx
page only. It is located in the same folder
as this configuration file. -->
<location path="ThePageThatUnauthenticatedUsersCanVisit.aspx">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>
<!-- This section gives the unauthenticated
user access to all of the files that are stored
in the TheDirectoryThatUnauthenticatedUsersCanVisit folder. -->
<location path="TheDirectoryThatUnauthenticatedUsersCanVisit">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>
</configuration>

Put the following in your web.config:
<location path="special.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>

<location path="register.aspx"> //path here is path to your register.aspx page
<system.web>
<authorization>
<allow users="*"/> // this will allow access to everyone to register.aspx
</authorization>
</system.web>
</location>
For more detail follow the below link
http://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Allow everyone to access a particular page
Sometimes you want to allow public access to some page and want to restrict access to rest of the site only to logged / authenticated users .i.e. do not allow anonymous access. Say your special.aspx is in your site's root folder. In the web.config of your website's root folder you need to have following setup.
<configuration>
<system.web>
<authentication mode="Forms"/>
<authorization> <deny users="?"/> //this will restrict anonymous user access
</authorization>
</system.web>
<location path="special.aspx"> //path here is path to your special.aspx page
<system.web>
<authorization>
<allow users="*"/> // this will allow access to everyone to special.aspx
</authorization>
</system.web>
</location>
</configuration>

How do I grant anonymous access to a url using FormsAuthentication?

For the most part, my webapp requires authentication to do anything. There are a few pages, namely the homepage, that I'd like people to be able to access without authenticating.
Specifically, I'd like to allow anonymous access to these urls:
/home
/default.aspx
I'm using asp.net MVC and FormsAuthentication. Both urls point to the same view:
/home/index.aspx
Here is my current configuration in web.config.
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
Reading the documentation for the authorization tag, it says "Configures the authorization for a Web application, controlling client access to URL resources." It seems like I should be able to use the authorization tag to specify a url and allow access.
Something like:
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
<authorization url="/default.aspx">
<allow users="?" />
</authorization>
<authorization url="/home">
<allow users="?" />
</authorization>

I hate to answer my own question, but since I did end up figuring it out, I figure I'd share the knowledge.
Use the location tag and put the allow and deny tags in the correct order.
The location tag can be used to configure a specific url resource. In my case I wanted to configure a few urls and folders specifically.
This didn't work at first because I didn't have the allow/deny in the correct order. According to MSDN, "the authorization module grants or denies access to a URL resource depending on whether the first access rule found is an allow or a deny rule."
In my case I needed to put all my public stuff first (default.aspx, home,styles, images, scripts) and then I put a deny on everything else. I left out the path on the last location tag. That makes it apply to all files and subfolders.
End result, a user can get to the homepage, pull up images and styles, but for everything else must log in.
Here's my web config file now:
<!--AUTHORIZATION AND AUTHENTICATION RULES-->
<location path="default.aspx">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<location path="Home">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<location path="Styles">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<location path="Scripts">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<location path="images">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
<location allowOverride="true">
<system.web>
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" slidingExpiration="true" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
<!--END AUTHORIZATION AND AUTHENTICATION RULES-->

Resources