ASP.NET 3.5: A Beginner's Guide - www.mustafaof.com

Chapter 16: Security 393So while you can severely restrict user access to a wide range of files on your server,you also can isolate certain directories and files where you want users to have full access.In effect, you have the best of both worlds; control over user access on some files andwide-open access on others.Developing a Forms Authentication ConfigurationThe first step in protecting your site is to develop a web.config file that has both anauthentication and an authorization filter. If you use Forms authentication, all users aresent to a login page on their first visit. Once they have been authenticated, they can returnto the site without having to go through a login process. For an e-business site, havingease of access is important for attracting and keeping customers.With Forms authentication, no matter what page the user requests, he is automaticallysent to a login page with the default name login.aspx. Once he fills out the logininformation, he is allowed to view the page requested initially. The following web.configfile shows the required tags:As noted, the authentication mode set to Forms automatically directs the browser toopen a file named login.aspx, but if you want to change that to a specific file with a nameyou prefer, you can specify which one you want by using the tagsFor the purposes of learning how to use the web.config set to Forms authentication, therest of the examples use the default login.aspx, but feel free to make changes to anotherfile if you wish.First Login ApplicationTo see how the web.config file from the previous section affects the flow, you will needto create a login file with the name login.aspx. The login web site that will be created isquite simple, but it has important consequences. Most importantly, the site uses