Asp.Net Authentication Module

Question

I have created an authentication module in ASP.Net but I do not want the logic in the authentication module to be executed if the resource is configured for anonymous access since the logic is expensive.

There are pages that require authentication in the same directory with pages that do not require authentication. I have no control over this. Is there an easy way to determine that a resource is configured to allow anonymous access prior to the URLAuthorizationModule?

Currently, I am doing the following which does "feel" right. Any help would be appreciated.

public static bool AllowEveryone()
        {
            bool rslt = false;

            AuthorizationSection config = (AuthorizationSection)WebConfigurationManager.GetSection("system.web/authorization");
            if (config.Rules != null && config.Rules.Count > 0)
            {

                AuthorizationRule r = config.Rules[0];  //doing this based on implementation of urlauthorization module in reflector...
                if (r.Action == AuthorizationRuleAction.Allow && r.Users.Contains("*"))
                {
                    return true;
                }

                //todo: check for allow anon ? case


            }

            return rslt;
        }

Answer 1

I'm not sure how your code fits in with the Membership and Role provider system, but have you tried putting per-URL overrides in the web.config file?

<location path="MyAnonymousPage.aspx">
    <system.web>
        <authorization>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>

Answer 2

Plz check my answer from this thread... http://stackoverflow.com/questions/995776/c-how-to-secure-webpages/995795#995795

Answer 3

In a regular ASP.Net site this can be accomplished with the following code:

IPrincipal anonUser = new GenericPrincipal(new GenericIdentity(string.Empty, string.Empty), new string[0]);

        bool allowAnon = UrlAuthorizationModule.CheckUrlAccessForPrincipal(requestPath, anonUser, "get");

however I am having problems getting it to behave as expected in SharePoint.