same Asp.net Forms Authentication for HTTP Handlers

Question

i have a website made in asp.net 4.0 running in azure webrole. i am using simple forms authentication and allow unautheticated GET requests to various pages , scripts and styles .
The problem is i have implemented a custom handler for extention ".kl" which actually is serving images based on the code with this extention. so suppose the output for 1.kl and 2.kl would be different.
i need to allow unauthenticated requests to this handler.
how should i do it?
this is the tag in my webconfig

<authentication mode="Forms">
      <forms loginUrl="~/UserPages/UserLogin.aspx" timeout="2880" name=".ASPXF2KAUTH" protection="All" path="/" defaultUrl="~/CodeGeneratorPages/SC_WC_CodeGen.aspx">
      </forms>
    </authentication>

astaykov · Accepted Answer · 2012-01-09 10:29:09Z

2

It is purely ASP.NET question, and the solution is one and the same for Azure and on-premis deployment.

You need to decide a single "folder" for where your handler will serve. For example it could be "/dynamic-images" or whatever. And make sure that all references/links you are generating are pointing at this folder ("~/dynamic-images/1.kl").

And now you need to add a location element in your configuration. Note that location is an immediate child of configuration (do not put it inside system.web):

<location path="dynamic-images">
    <system.web>
       <authorization>
          <allow users="*" />
       </authorization>
    </system.web>
</location>

There is no other way (that I know) to achieve your goal.

answered Jan 9, 2012 at 10:29

astaykov

30.8k3 gold badges72 silver badges86 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Parv Sharma · Accepted Answer · 2012-01-09 10:59:42Z

0

also one more solution to this quest that i figuredout by myself is that allow UnAuthenticated access by default to the root directory of the website then deny access to all the folders and child path.. that way any handler would be allowed to be accessed by any anynomous user where as all the child paths wont be allowed.

answered Jan 9, 2012 at 10:59

Parv Sharma

12.7k5 gold badges52 silver badges83 bronze badges

1 Comment

astaykov Over a year ago

If you want to go for that approach, I would suggest a slight modification. Open access to the full application. Then create a /secure folder (or appropriate name) and apply authentication and authorization only over that folder. You can have multiple sub-folders within it. This is easier and clear to maintain. I don't suggest managing auth rules for all folders, as it would very soon become a nightmare for the team who will maintain this application (and even for the one who created it).

Collectives™ on Stack Overflow

same Asp.net Forms Authentication for HTTP Handlers

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related