ASP.MVC :Web.Config and Authorize attribute

Question

I have an AdminController protected by an Authorize attribute like this

[Authorize(Roles = "Admin")]
public class AdminController :  BaseController
{
.....
}

And I have in my web.config this security location section

<location path="admin">
   <system.webServer>
       <security>
          <authorization>
            <remove users="*" roles="" verbs="" />
            <add accessType="Allow" roles="Admin" />
          </authorization>
       </security>
   </system.webServer>
</location>

If I remove the web config section, everything works perfectly and only Admin can access Admin actions With the section in, I am always redirected to my login page

However, I need the web.config section because I have some static files on the Admin folder that I want to be protected and accessed only by Admin role

What's wrong with my web.config Thanks

unless a new syntax came out and I'm unaware, the correct tag is <deny> instead of <remove>... — GR7
– GR7, Commented May 1, 2011 at 14:34

MarkKGreenway · Accepted Answer · 2010-07-26 14:20:16Z

1

easiest way is to add a new web config file to the admin section

<?xml version="1.0"?>
<configuration>
    <system.web>     
        <authorization>
          <deny users="*" />
          <allow roles="Admin" />   
       </authorization>
    </system.web>
</configuration>

answered Jul 26, 2010 at 14:20

MarkKGreenway

8,8046 gold badges36 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

ASP.MVC :Web.Config and Authorize attribute

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related