I have a project containing an image, css and js folder.
I want to make sure no css, image or js is blocked when using formsauthentication.
I know you can do this with the locationtag in the web.config but I was wondering if you could do this otherweise?
this is how I do it right now:
<location path="css">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<location path="images">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
I'm using asp.net (c#) with iis 7.0.
Cheers,
M.
Set the folder permissions for your CSS/images directories, to allows anonymous access.
This is done in the web.config, not filesystem permissions.
It is a good practice to serve static resources such as images and css from a cookie-free domain.
I was seeking the same answer however in my case it is allowing access to CSS, Images and JS files by default. I think it only requires authentication if for ASPX (etc).
Also, I am using deny users "?" rather than "*"
Related
I have an asp.net 3.5 website with using forms authentication and asp.net roles and membership. I have an image in folder images. In my web.config i give access to this folder
<location path="images">
<system.web>
<authorization>
<!-- Order and case are important below -->
<allow roles="*"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
I can see the image from a page in my root. When i traverse to a page(Page.aspx) one folder down, the image is not visible, i.e /Operational/Page.aspx.
How should i setup authorisation with regards to subfolders?
It can be a path issue. As I guess you settings are good you don't need to change it.
You can view the path in the browser and see if there path are correct or not.
You can use firebug or Firefox to check the path.
I am using MembershipProvider and currently a have 3 roles:
User, Super User, Admin.
Also I have pages that can be seen only by Admin and Super User.
For these pages a I use configuration in web config:
<location path="Users.aspx">
<system.web>
<authorization>
<allow roles="Admin, Super User"/>
<deny users="*" />
</authorization>
</system.web>
</location>
And this works perfectly fine.
But I have bunch of pages
Evaluations
Actions
Reports
Files
to which a I want separate access. I want grant access to each page individually.
Is there better way to do it than create roles for each page and than assign to these roles?
P.S.
I am using ASP.NET, not MVC
Yes, modify your folder structure to be something like this:
- Super User
- Admin
- All
And then you can do stuff like this:
<location path="Super User">
<system.web>
<authorization>
<allow roles="Super User"/>
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="Super User/Admin">
<system.web>
<authorization>
<allow roles="Admin"/>
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="Super User/Admin/All">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
And now simply place the pages in the appropriate folders. Per the MSDN Documentation the location element applies to all sub-directories:
Specifies the resource that the contained configuration settings apply to. Using location with a missing path attribute applies the configuration settings to the current directory and all child directories. If location is used with no path attribute and allowOverride is False, configuration settings cannot be altered by Web.config files that are in child directories.
so Super User by definition will have access to all other pages below and so on.
Yes, there is a better a simpler way. Put all your restricted pages in a separate folder and create an additional web.config in this folder. This additional web.config should contain the authorization section only.
The runtime will evaluate your web.configs from the request folder up to the application root. Because the authorization section exists in this additional web.config it will overwrite your root authorization section.
This way a single setting (single web.config) can guard arbitrary number of files (all files in the directory).
You can also assign permissions to a folder instead using the <location> element. This way, you can group a bunch of pages into one permission set. Also, you could validate permissions in code; in global.asax, the application_postauthenticaterequest runs for each request to the server (so for each aspx page), and you can write code here to do the validation, and redirect away if the user doesn't have the permissions.
Possibly a stupid question:
I have a site, developed by an outside company, which requires logon for all pages.
We'd like to add a single page to the site that DOESN'T require the user to be logged in...so they can click the link on the logon page to view "T&C's" type info.
Is this possible?
(ASP.Net 4.0 on IIS)
If you're using the ASP.Net membership providers you can specify this in the web.config file. Where for blocked pages you would expect:
<authorization>
<allow roles="granted"/>
<deny users ="*"/>
</authorization>
you can specify this per folder (or per page):
<location path="terms.aspx">
<system.web>
<authorization>
<allow users ="*"/>
</authorization>
</system.web>
</location>
to allow everyone access to this specific page.
Note that you can create a specific web.config in a folder in your website, these settings override the general web.config. This allows you to customize these settings per folder level.
Thanks to oɔɯǝɹ for pointing me in the right direction:
Added this after my node
<location path="terms.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
Will this only have static content? Is it the asp.net application dealing with authentication?
If so you can just upload a .html file containing simple HTML (and your T&C) which will be served no problem to anyone requesting it.
I'm looking to deploy a web app and I have a simple question about the <location> tag of the web.config file. For the moment, I want all the pages to be password protected and I've created a simple login page with the login object. I've put all my .aspx file in a directory called AppMyPages and I've put this in the config file:
<location path="AppMyPages">
<system.web>
<authorization>
<allow roles="tester" />
<deny users="*" />
</authorization>
</system.web>
</location>
If I want to fully protect my site, do I need to do the same thing for all the other folders (AppCode, AppData, MyJavascripts, MyStylesheets, MyImages....)?
Thanks.
You don't have to do AppCode/AppData, but you need to be careful restricting the MyJavascripts/Stylesheets/Images if any of those resources are used on unauthenticated pages (e.g. Login page).
I have created a login page. In this page i used div tag which is mapped with images for good design purposes. i have enabled the forms authentication in web.config.
So finally images i mapped in div is not appearing in the login page.
please help me!
If the images are not meant to be protected and should be visible on all pages, then I would add a location tag in the main web.config:
<location path="images">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
Add a web.config file to your images directory containing the following:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</configuration>
This will allow your login page, which is usually viewed by unauthenticated users, to show images.
I assume the images are not displaying due to access? Where do the images exist? If they exist in a directory that is locked down to forms authentication, the pictures cannot display.
Try adding a web.config file to your images directory and to allow public access to these files.
Here is what the web.config should contain:
<?xml version="1.0"?>
<configuration>
<location path="images">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<system.web>
<!-- Your normal web.config stuff here -->
</system.web>
</configuration>
Also check your IIS settings for the application in general to make sure you are allowing anonymous access.
EDIT: Make sure to move your images to a folder that does not require authorization. If you have them in the same directory as your secured aspx pages then you won't be able to access them.
EDIT 2: Included the info provide by Thomas and Sky Sanders as it included a better solution. See comment threads on answers for more information.