Problem solve Get help with specific problems with your technologies, process and projects.

Limiting user access in ASP.NET

Protecting privileged directories in ASP.NET requires strong authorization methods. Expert Dan Cornell breaks down the best techniques for access control in .NET 2.0 applications.

In ASP.NET how can I limit access to certain directories to only users who have logged in with different roles? For example, how can I limit access to Admin/, Customer/ and Client/ directories to users who have logged in with those roles?

ASP.NET provides robust URL-based authorization capabilities allowing you to control access to directories by users, roles and even by HTTP verbs (GET, POST, and so on).

First, you need to set up your application to use either Forms or Windows authentication and configure the system to have three different roles: Admin, Customer and Client. In Windows authentication these will map to user groups and in Forms authentication those groups must be set up manually. See "Forms Authentication differences in ASP.NET 2.0" for more information on the disparities in Forms authentication between ASP.NET 1.1 and ASP.NET 2.0.

Once you have your Web application set up to authenticate users, you need to tell ASP.NET to require specific authorization in order to access resources. Web.config files supply configuration information for the directory in which they are located and all resources below them. By setting up a proper <authorization> tag in the web.config file you can control what users are allowed access to the directories.

ASP.NET security resources:
How to create a secure login page using ASP.NET

Discover the power of .NET's code access security

Authentication & authorization: Secure ID and user privileges

Forms Authentication -- Professional ASP.NET 2.0 Security, Membership and Role Management

To allow access only to users with the Admin role for the Admin/ directory, the <authorization> tag should be set up as follows:


    <allow roles="Admin" />

    <deny roles="*" />


This will allow users with a role of Admin to access files in the Admin/ directory and will disallow all others.

Here is a great MSDN reference article with more specifics and syntax information for URL authentication.

Dig Deeper on Topics Archive