Allow web.config authorization

Question

I am developing .NET for an ASP.NET web application and trying to prevent all users who are unauthorized from accessing my application but only allow them a login page.

Below is a snippet of code that is inside my system.web section:

<authentication mode="Forms">
   <forms loginUrl="Login.aspx" timeout="60" name="APPNAME" slidingExpiration="true" />
</authentication>
<authorization>
   <deny users="?" />
</authorization>

I also have this outside to allow access to the login page:

  <location path="Login.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

However, I can still access the pages when I am not logged in, how can I stop this?

I even added the Web.Config file to the main folder, which stores most of the website files whose contents are:

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

But it still has no effect.

Decision

asp.net(http://www.codeproject.com/KB/aspnet/10ASPNetPerformance.aspx) HTTPModule AnonymousIdentification, .

Answer 1

, , ASP.NET, - . . .

VS 2010 ( , -), ASP.NET "".

, , web.config , , , .

ASP.NET VS 2010, , , :

web.config

 <system.web>
    <authorization>
      <deny users="?" />
    </authorization>

web.config " "

<?xml version="1.0"?>
<configuration>

  <location path="Register.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

  <system.web>
    <authorization>
      <allow users="?" />
    </authorization>
  </system.web>

</configuration>

, , , .

Answer 2

LoginStatus , .

, " ". , control userpassword2.

Answer 3

You can put the new Web.config file in the folder for which you need the appropriate permissions. Inside it do something like this

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

Or you may need to wrap the <authorization>tag <security>.