Groups | Blog | Home
all groups > dotnet security > october 2004 >

dotnet security : SubFolder Security


Nicole Calinoiu
10/11/2004 7:24:49 AM
Is this a web application or a Windows Forms application?


[quoted text, click to view]

Mohamed
10/11/2004 12:00:45 PM
Hi all
I am using .NET FrameWork 1.1
and i include in my project a folder named "Forum"
and i want that nobody can enter the forum folder wizout logining into the
system
the forum is a subdirectory in my project
thanks

Nicole Calinoiu
10/12/2004 8:05:47 AM
That would have been my guess too, but you never know... <g>

If it is a web application and your approach is used, it would also be a
really good idea to implement one of the suggested fixes from
http://www.microsoft.com/security/incident/aspnet.mspx.


[quoted text, click to view]

Andreas Håkansson
10/12/2004 10:39:22 AM
My guess is a web application in which case you can use the location element
in
the web.config file to apply settings for various parts of your site. This
is the
prefered way over using multiple config files.

Add the following (adapted) to your web.config

<configuration>
<location path="/Forum">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>

This will deny all anonymous (? means anonymous users) access to the /Forum
sub
folder of your site.

HTH,

//Andreas

"Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> skrev i meddelandet
news:uTy8bU4rEHA.2008@TK2MSFTNGP12.phx.gbl...
[quoted text, click to view]

Andreas Håkansson
10/12/2004 4:26:05 PM
Nicole,

Yeah, good advice. The canonicalization issue kinda leaves your
back door unlocked =P

//Andreas

"Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT com> skrev i meddelandet
news:%23puzWbFsEHA.3076@TK2MSFTNGP10.phx.gbl...
[quoted text, click to view]

AddThis Social Bookmark Button