Password protection folder with web.config

Question

I need to password protect a directory on a Windows server. The page should display a list of files located in this directory. I don't have any previous knowledge (only with Apache before), so I tried to hack something together with googling. (For someone who knows what they are doing, I'm sure it will look ridiculous).

What I have now, I get a login popup, but the password does not work. We have a table in our SQL database for administrators, so choosing from a user input or having an input built into the configuration file is great. All I need is a password protected folder.

This is what I have right now in my web.config file, which is located in a folder that should be password protected.

<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.web> <authentication mode="Forms"> <credentials passwordFormat="Clear"> <user name="test" password="test" /> </credentials> </authentication> <authorization> <allow users="test" /> <deny users="*" /> </authorization> </system.web> <system.webServer> <directoryBrowse enabled="true" /> <security> <authentication> <anonymousAuthentication enabled="false" /> <basicAuthentication enabled="true" /> <windowsAuthentication enabled="false" /> </authentication> </security> </system.webServer> </configuration> 

Hope this is a simple problem and in advance for your help! :)

Answer 1

Try the following:

 <configuration> <system.web> <authentication mode="Forms"> <credentials passwordFormat="Clear"> <user name="test" password="test" /> </credentials> </authentication> <authorization> <allow users="test" /> <deny users="*" /> </authorization> </system.web> <location path="admin"> <system.web> <authorization> <allow roles="admin" /> <deny users="*"/> </authorization> </system.web> </location> <system.webServer> <directoryBrowse enabled="true" /> <security> <authentication> <anonymousAuthentication enabled="false" /> <basicAuthentication enabled="true" /> <windowsAuthentication enabled="false" /> </authentication> </security> </system.webServer> </configuration> 

You can encrypt user information using something like this:

 aspnet_regiis.exe -pef "sectionName" C:\Path\To\Your\Application