How to prevent non-local access, using ASP.NET windows forms authentication

Question

I have an application that uses http-calls to local webservices. While the whole application secured by ASP.NET forms authorization, I want a specific folder to be available to local-calls only.

How can I do that?

Thanks!

Answer 1

In your web.config you can do something like:

  <location path="~/blog/add">
    <system.web>
      <authorization>
        <allow users="admin" />
        <deny users="*" />
      </authorization>
    </system.web>
  </location>

Answer 2

I don't think there is anything native in forms authentication that will do that. You'll either have to;

1. Extend forms authentication to cope with this (I think it is sealed in places though).
2. Have all of the items in that folder inherit from a base class that checks the IP address of the caller.
3. Use IIS to lock down that directory to local clients (in IIS7 this can be done in .config I believe).
4. Add a HTTP handler to intercept calls to that directory and redirect them if not local (this might be easiest).

Hope that helps, a little vague but a starting point.

Answer 3

All of Ryan's suggestions are good. Here are two more (variations on his point # 2).

In the Global.asax, you can use the Application_BeginRequest to do something like this:

if (Request.UserHostAddress != "127.0.0.1" && !Request.UserHostAddress.StartsWith("172.16") && Request.Url.AbsolutePath.Contains("AdminFolderName"))
{
    Response.Redirect("~/somenonproectedpageornoaccessmessagepage.aspx", true);
}

or use a MasterPage for each aspx page in that folder and put the following in the Page_Load

if (Request.UserHostAddress != "127.0.0.1" && !Request.UserHostAddress.StartsWith("172.16"))
{
    Response.Redirect("http://www.kwiktrip.com", true);
}