What's the easiest way to secure a web folder?

[gnewsgroup]

I have a membership web application. A user is either an
administrator or a regular user (only 2 roles)

I have an admin folder in this application. I want only
administrators to be able to access that folder.

I am not using the .net member/role/profile framework. What's the
easiest way to secure that admin folder?

Thanks.

 

[Misbah Arefin]

set the role required for the admin pages via the locations section in the
web.config

<location path="admin">
<system.web>
<authorization>
<allow roles="admin" />
<deny users="*" />
</authorization>
</system.web>
</location>

 

[Juan T. Llibre]

re:
!> set the role required for the admin pages via the locations section in the web.config

The OP specifically stated that he is *not* using the "member/role/profile framework"

So, the easiest way to secure that admin folder is to *implement membership and roles*,
and *then* secure the folder as you describe in your answer.




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
======================================

 

[gnewsgroup]

re:
!> set the role required for the admin pages via the locations section in the web.config

The OP specifically stated that he is *not* using the "member/role/profileframework"

So, the easiest way to secure that admin folder is to *implement membership and roles*,
and *then* secure the folder as you describe in your answer.

Juan T. Llibre, asp.net MVP
asp.net faq :http://asp.net.do/faq/
foros de asp.net, en español :http://asp.net.do/foros/

Haha, that's a good answer. I may look into it and implement a very
basic membership provider. Thx.

 

[Juan T. Llibre]

re:
!> Haha, that's a good answer.

<chuckle>

re:
!> I may look into it and implement a very basic membership provider.

That will, certainly, do it for you.

re:
!> Thx.

You're quite welcome.
If you run into any problems implementing the membership provider or the roles, post again.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
======================================

re:
!> set the role required for the admin pages via the locations section in the web.config

The OP specifically stated that he is *not* using the "member/role/profile framework"

So, the easiest way to secure that admin folder is to *implement membership and roles*,
and *then* secure the folder as you describe in your answer.

Juan T. Llibre, asp.net MVP
asp.net faq :http://asp.net.do/faq/
foros de asp.net, en español :http://asp.net.do/foros/

Haha, that's a good answer. I may look into it and implement a very
basic membership provider. Thx.