authorization based on url parameters

[xke]

Using web.config authorization settings, is it possible to allow my
users to access default.aspx but not default.aspx?action=edit ??

<location path="default.aspx">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>

Thanks

xke

 

[Peter Bradley]

If you don't want your users to use it, then why is it there?

If you mean that you only want a certain type of user to be able to use it,
then it seems to me that you need role-based authorisation. This is
probably most easily done by using forms authentication. Once you have
obtained the roles (from a database or whatever) for the user, you can use
attributes on your classes and/or methods to determine which types of user
can do what (e.g. you can use attributes to ensure that a user trying to
access the edit functionality is both logged in and a member of the "edit"
role (or whatever you might like to call it)). If they are not
authenticated, a SecurityException will be thrown - which you must make sure
to catch (probably in Global.aspx).

HTH


Peter

 

[xke]

Hi Peter,

True, sorry, I only want users with certain roles to be able to access
the page.
So, only let's say, Role:Admin will be able to access default.aspx?
action=edit

I was wondering if this can be done only by using web.config settings,
something like

<location path="default.aspx">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>

<location path="default.aspx?action=edit">
<system.web>
<authorization>
<allow roles ="Admin" />
<deny users="?" />
</authorization>
</system.web>
</location>

About the last setting I've added of course it won't work, as path
attribute will only accept virtual paths with no querystring
parameters.

Thanks

 

[Peter Bradley]

You might be able to (although I can't see how the role information is being
transmitted), but the only sure way I know of, is to use Forms
authentication.

Others may know better.

Cheers


Peter

 

[David Longnecker]

If you have a method that is calling the "edit" command based on what your
action querystring is equal to, you could just use:

If (Roles.IsUserInRole("Admin"))
{
\\ Do whatever it is that they have access to, get forwarded to, etc.

}

Else, leave the Visible=false set on those objects.