<authorization> can protect pages?

Question

Can I use <authorization> to protect webforms from being accessed if a person does not have a specific role?

I tried this:

<authentication mode="windows" />

<authorization>
  <allow roles="Admin" />
  <deny users="*"
</authorization>

but if the role Admin is not available then I can still visit the page by typing in the url. How can I protect this page?

I read the documentations on MSDN like ASP.NET Authorization. I also put the UrlAuthorizeModule extra in the web.config to make sure that it gets hit.

Answer 1

Best to read this: ASP.NET Authorization

It explains how to set the allow/deny elements for users and roles.