Authorization for ASP.NET MVC site

Question

Hi,

I have a data driven asp.net mvc app. The Url of the pages is data driven too, so they cannot be hardcoded in web.config. We are ready to deploy the website and for initial few days we want the pages to be accessible only after logging in.

Is it possible to add authorization to the site and then take it out by changing the web.config only? I have added this:

<authentication mode="Forms">
  <forms loginUrl="Login.aspx" timeout="20">
    <credentials passwordFormat="Clear">
      <user name="admin" password="adminpwd" />
    </credentials>
  </forms>
</authentication>
<authorization>
  <deny users="?" />
</authorization>

However, this doesn’t work.

I have also tried location tag, but not sure what path to specify in that.

  <location>
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>

Please note: the default error page should work without authorization

<customErrors mode="Off" defaultRedirect="/error">
</customErrors>

Can you help?

Thanks!

Answer 1

Have you tried:

<authorization>
  <deny users="?" />
  <allow users="*" />
</authorization>

It is evaluated top-down, so first deny all anonymous users and then allow all other users (i.e. all authenticated users)

Answer 2

Perhaps the [Authorize] attribute on the Controllers Actions? Maybe this will help.

Answer 3

Is this just a temporary restriction while it's being tested on the production server? If so, you could try regular HTTP Authentication.