Authorization .NET. Does order mean or allow and deny elements?

Question

I'm curious if the order in which you put the <allow> and <deny> elements in the element matters?

Answer 1

Yes, order matters. This page describes the basic principles: http://msdn.microsoft.com/en-us/library/wce3kxhd.aspx . According to the page, a list of authorization rules is created from the hierarchy of configuration files, and then the first match is won.

There is a nice example in this SO question: ASP.NET Forms Auth Allowing access to a specific file in a subdirectory when all others should be denied