How to deny access to a file with ASP.NET web config but not just locally?

asp.net web-config membership
Morteza Hasani picture Morteza Hasani · Mar 3, 2011 · Viewed 12k times · Source

I have a problem with ASP.NET web configuration file. I want to deny some users or roles to accessing a specific PDF file. I am using ASP.NET membership and role management system. So I added this lines of codes to a Web.config file:

<location path="myfile.pdf">
    <system.web>
        <authorization>
            <allow roles="admin"/>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>

and put it to the directory witch the file is included in it. Now when I run the project in local system I can not access the PDF file wile I login with "admin" role. But when I publish the project on the web server I can not brows the folder but I can view the PDF file when I browse complete path to the PDF file. So:

I can not access: http://www.example.com/folder

but I can view: http://www.example.com/folder/myfile.pdf

Answer

Josh M. picture Josh M. · Mar 7, 2011

IIS is probably serving the PDF file before ASP.Net gets its hands on it. Assuming you're using .Net 4.0, add this to your Web.config file to force all requests to flow through to ASP.Net:

<system.webServer>
    <modules runAllManagedModulesForAllRequests="true"/>
<system.webServer>

Related questions

Setting up connection string in ASP.NET to SQL SERVER

I'm trying to set up a connecting string in my web.config file (Visual Studio 2008/ASP.NET 3.5) to a local server (SQL server 2008). In my web.config, how and where do I place the connection string? Here's what web.config …

Read More
Login failed for user 'IIS APPPOOL\ASP.NET v4.0'

I have a web project (C# Asp.Net, EF 4, MS SQL 2008 and IIS 7) and I need to migrate it to IIS 7 locally (at the moment works fine with CASSINI). Locally in IIS I have my Default Web Site with my …

Read More
Read connection string from web.config

How can I read a connection string from a web.config file into a public class contained within a class library? I've tried: WebConfigurationManager ConfigurationManager But these classes are not recognized within my class library.

Read More