Building Secure ASP.NET Applications - People Search Directory

152
Building Secure ASP.NET Applications
To configure ASP.NET impersonation use the following element in
your application’s Web.config.
3. Configure Authorization. URL authorization determines whether a user or role
can issue specific HTTP verbs (for example, GET, HEAD, and POST) to a specific
file. To implement URL authorization, you perform the following tasks.
a. Add an element to the Web.config file located in your
application’s virtual root directory.
b. Restrict access to users and roles by using allow and deny attributes. The
following example from Web.config uses Windows authentication and allows
Bob and Mary access but denies everyone else.
Important: You need to add either or at the
end of the element, otherwise access is granted to all authenticated
identities.
URL Authorization Notes
Take note of the following when you configure URL authorization:
● “*” refers to all identities.
●
●
●
“?” refers to unauthenticated identities (that is, the anonymous identity).
You don’t need to impersonate for URL authorization to work.
Authorization settings in Web.config usually refer to all of the files in the current
directory and all subdirectories (unless a subdirectory contains its own
Web.config with an element. In this case the settings in the
subdirectory override the parent directory settings).
Note: URL authorization only applies to file types that are mapped by IIS to the ASP.NET
ISAPI extension, aspnet_isapi.dll.