Restrict access to a specific URL, running on IIS7 / ASP.NET

Question

I am deploying a public ASP.NET website on an IIS7 web farm.

The application runs on 3 web servers and is behind a firewall.

We want to create a single page on the website that is accessible only to internal users. It is primarily used for diagnostics, trigger cache expiry, etc.

/admin/somepage.aspx

What is the best way to control access to this page? We need to:

Prevent all external (public) users from accessing the URL.
Permit specific internal users to access the page, only from certain IPs or networks.

Should this access control be done at the (a) network level, (b) application level, etc.?

frankadelic · Accepted Answer · 2010-11-05 21:08:04Z

2

I found the best solution was to place an irule on our F5 load balancer.

We created a rule that the load balancer would drop all external requests for the specific directory. Internally, we could still hit the pages by connecting directly to the servers in the farm.

answered Nov 5, 2010 at 21:08

frankadelic

20.9k37 gold badges114 silver badges167 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

abatishchev · Accepted Answer · 2010-06-10 20:44:56Z

1

Here is how to secure specific page for specific users and only them

<configuration>
    <location path="admin/somepage.aspx">
        <system.web>
            <authorization>
                <allow users="User1,User2" />
                <deny users="*" />
            </authorization>
        </system.web>
    </location>
</configuration>

To set allowed IP you need to configure web site in IIS via IPv4 Address and Domain Restriction where add a wildcard Deny Entry and specif Allow Entries.

Also you can setup all this programmatically.

answered Jun 10, 2010 at 20:44

abatishchev

101k88 gold badges303 silver badges443 bronze badges

Comments

Ed B · Accepted Answer · 2010-06-10 20:45:35Z

0

A simple implementation would be to set File Security on that File in IIS to Integrated Windows Authentication only.

Then in that file's code behind, check for the user's ID..if they are authenticated, they will have an ID, and let them access the page.

if(!HttpContext.Current.User.Identity.IsAuthenticated)
{
   //Direct user to other page or  display message.
}

When users go to that page, it will ask them for their network login

answered Jun 10, 2010 at 20:45

Ed B

6,0543 gold badges29 silver badges35 bronze badges

Collectives™ on Stack Overflow

Restrict access to a specific URL, running on IIS7 / ASP.NET

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related