Geek Answers Handbook

Asp.net Form Authentication

I am working on an Asp.net Application, where I have 4 roles in my application. 1. Administrator 2. User 3. Reseller 4. Affiliate program. And I use Authentication for this, so that everything works fine for a single role (User). But now I have 4 roles, and I do not understand how this can be done. I have 4 folders for different users. If I log in with a reseller account, and if I change the URL for the user, this will also allow me to access the user part. But I do not want this. I need the user to be able to access only their access area in my application. Means If your reseller has registered, he can only access the pages of the reseller or the same folder.

Please help me find this solution.

+5
source share
5 answers

There are two things here. First of all, restricting access to each folder by role should be quite simple if you use elements <location>in your web.config, for example.

<location path="Resellers">
    <system.web>
        <authorization>
            <allow roles="Reseller"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>

<location path="Users">
    <system.web>
        <authorization>
            <allow roles="User"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>
...

Also on your individual pages, you can call a function IsUserInRoleto check if your user has the correct role to access the page.

You might want to get a copy. Starting with ASP.NET protection , she got some great information on how to do this.

+1
source

web.config , , :

[PrincipalPermissionAttribute(SecurityAction.Demand, Role = @"Administrators")]

, . , , .

+1

web.config , , ..

<authorization>
  <deny users="?" />
  <allow roles="Administrators" />
  <deny users="*" />
</authorization>

"".

0

web.config, . , web.config, :

<authorization>
  <deny users="*"/>
  <allow roles="Resellers"/>
</authorization>

.

0
source

use the code below:

<location path="Users">
        <system.web>
            <authorization>
                <allow roles="Users"/>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>
0
source

More articles:


All Articles