Asp.net Path Access

Question

I want to learn that which way is safer to deny page access.I know one of them for folder access.I don't need folders.

1. way

 <location path="xfile">
    <system.web>
      <authorization>
        <allow roles="admin"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

or 2. way

protected void Page_Load(object sender, EventArgs e)
    {
        if (!this.Page.User.Identity.IsAuthenticated)
        {
            Response.Redirect("/Login");
        }
        else
        {
            if (User.IsInRole("admin"))
            {
                // my action
            }
            else
            {
                Response.Redirect("/");
            }
        }
    }

Have to I use folders for security? OR 2. way is unsafe ?

Ghini Antonio · Accepted Answer · 2017-03-15 09:51:04Z

1

 <location path="myPage.aspx">
    <system.web>
      <authorization>
        <allow roles="admin"/>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

Check this link: https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

answered Mar 15, 2017 at 9:51

Ghini Antonio

3,1633 gold badges28 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

serdar Over a year ago

Thank you.I know this but I want to learn which one is better.

Ghini Antonio Over a year ago

What is better depend what are your requirements. In a simple case you should enable form authentication and set loginUrl to the page that contains login form. Then set your authorization rules in web.config

Collectives™ on Stack Overflow

Asp.net Path Access

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related