How do I configure ASP.net forms authentication to deny only a specific URL and sub-URLs?

Question

I am using ASP.NET4 with MVC3. I would like to configure my website to use forms Authentication in the following way:

UNauthenticated users should have access to everything (i.e. /, /home, /freebies )...
... except for anything under /paidServices (i.e. /paidServices/fancy, /paidServices)

How do I configure this in my web.config file? My current configuration always goes to the logon page when the user hits the root URL(/), but it should not. It should only go to the logon page if the user tries to access the /paidServices url.

My configuration is as follows:

<configuration>
    <system.web>
        <authentication mode="Forms">
          <forms loginUrl="~/Account/LogOn" path="/" timeout="2880" />
        </authentication>
        <authorization>
          <allow users="*"/>
        </authorization>
    </system.web>

    <location path="~/paidServices">
        <system.web>
            <authorization>
                <deny users="?"/>
            </authorization>
        </system.web>
    </location>

    ... etc ...
</configuration>

What am I doing wrong? Is the fact that I am using ASP.NET MVC making this more complicated?

Are you using the Authorize attribute on the relevant controllers? See: this SO question for a similar question and answer demonstrating how to do this — Alan Savage
– Alan Savage, Commented May 7, 2011 at 11:36

Gats · Accepted Answer · 2011-05-07 11:34:08Z

2

It's better practice to use Authorize attributes in MVC. These can be applied to a whole controller or just a single controller action.

For example:

[Authorize]
public class paidServicesController
{
 ....

answered May 7, 2011 at 11:34

Gats

3,46221 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

willem · Accepted Answer · 2011-05-07 11:54:29Z

1

False alarm. The configuration is question was correct. I omitted a URL in my MVC routes configuration, so the default URL (/) was going to the secure section and the Logon form was being shown as expected.

Phil Haack's Route Debugger helped pinpoint the problem: http://haacked.com/archive/2008/03/13/url-routing-debugger.aspx

answered May 7, 2011 at 11:54

willem

27.2k23 gold badges81 silver badges120 bronze badges

Collectives™ on Stack Overflow

How do I configure ASP.net forms authentication to deny only a specific URL and sub-URLs?

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related