Authorization rejected message using FormsAuthentication

Question

So, I implemented my IPrincipal.IsInRole (...), and I use FormsAuthentication as follows:

<authentication mode="Forms">
     <forms loginUrl="Login.aspx" name="someName" timeout="600"/>
</authentication>

Then I have a page that requires you to be authenticated and you have "roleA". This is set up like this:

 <location path="SomePage.aspx">
  <system.web>
   <authorization>
    <allow roles="roleA" />
    <deny users="*"/>
   </authorization>
  </system.web>
 </location>

Now I can log in to my web application, but with a user who does not have a role. When I visit SomePage.aspx, I am redirected to Login.aspx, the url specified in the loginUrl of the forms element. So my question is, should I not indicate an authorization refusal message or URL? If the user is authenticated but not authorized, why do I want to redirect to the login page. This is confusing for the user. Please tell me that I missed something simple.

Thanks for reading!

Answer 1

, . , - , (?), , - URL-, ASP.NET , .

web.config, /, URL- , :

<configSections>
    <section name="authorizationFailureMessages" type="System.Configuration.NameValueSectionHandler, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
    ...etc...
</configSections>

<authorizationFailureMessages>
    <add key="MemberResources" value="MembershipRequired" />
    <add key="Staff" value="StaffOnly" />
    <add key="Departments/Administration/BoardOfDirectors" value="BoardOfDirectorsOnly" />
    ...etc...
</authorizationFailureMessages>

Page_Load() Login.aspx , URL-, , (un) , , :

private void DisplayAppropriateAuthorizationMessage ()
{
    if ( !Page.User.Identity.IsAuthenticated )
        return;

    string redirectUrl = FormsAuthentication.GetRedirectUrl( Page.User.Identity.Name, false );

    if ( string.IsNullOrEmpty( redirectUrl ) )
        return;

    NameValueCollection authorizationFailureMessages = ConfigurationManager.GetSection( "authorizationFailureMessages" ) as NameValueCollection;

    if ( authorizationFailureMessages == null )
        return;

    foreach ( string key in authorizationFailureMessages.AllKeys )
    {
        if ( redirectUrl.Contains( key ) )
        {
            Response.Redirect( String.Format( "Message.aspx?{0}={1}", Constants.QueryStringKeys.ERRORMESSAGENAME, authorizationFailureMessages[ key ] ), true );
        }
    }
}

Answer 2

Roles.IsUserInRole. , . , web.config, . , .

Answer 3

@MattPeterson. .

• In my opinion, you simply say that "in accordance with the roles that you are, you are not allowed to visit this page," this is enough. You do not need to specify what additional roles are needed, and you can find out the details of authorization of your site.

• You can get the access control list from web.config (in each folder), and you do not need to write again <add key="MemberResources" value="MembershipRequired" />.

I believe that you should have something similar to

<authorization>
    <deny users="?" />
</authorization

in your web.config.