.NET: understanding web.config in asp.net

Question

Does anyone know of a good link to explain how to use web.config ......

For example, I use forms authentication ... and I notice that there is system.web, and then it is closed by /system.web, and then there are additional location tags below the configuration

here is an example, if you don’t have authentication mode = authorization form, I suppose it is ROOT ....... It is also contained inside system.web .... Below this is more location = with system.web tags. ...

I never understood what I was actually doing. I tried checking the MSDN documentation, but still I don't quite understand ...

Can anyone help?

If you notice in my example .... everything is stored in 1 web.config ... I thought the standard version would create a standard web.config and then create another web.config in the directory where I want to protect it .. ???

<configuration>

     <system.web>
           <compilation debug="true" strict="false" explicit="true" targetFramework="4.0" />

           <authentication mode="Forms">
        <forms loginUrl="Login.aspx" defaultUrl="Login.aspx" cookieless="UseCookies" timeout="60"/>
    </authentication>

    <authorization>
        <allow users="*"/>
    </authorization>

       </system.web>


<location path="Forms">
    <system.web>
        <authorization>
            <deny users="?"/>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>
<location path="Forms/Seguridad">
    <system.web>
        <authorization>
            <allow roles="Administrador"/>
            <deny users="?"/>
        </authorization>
    </system.web>
</location>

Answer 1

The standard entries (web.config are extensible) are well documented in it.

http://msdn.microsoft.com/en-us/library/aa719558.aspx

- a good start.

This - as should be obvious - is based on XML, btw.

Answer 2

You can put the following web.config file in Forms / Seguridad:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
        <authorization>
            <allow roles="Administrators" />
            <deny users="*" />
        </authorization>
    </system.web>
</configuration>