web.config authorization and direct method calling

Question

Hey everyone,
I'm using ASP.NET and rely on the web.config file to secure sections of my site. However, is this truly reliable, or is it also a good idea to add an IsAuthenticated check in the Page_Load event? Also, is it possible for someone to directly call methods (assuming they somehow got my method names and method signature) in my application's DLL? For example, I have a method to add users to a specific group. Can an attacker somehow call that method through their own custom POST and execute it? Thanks

Answer 1

If you are concerned about specific methods being executed without permission, I'd use code attribute security or your own roles check system to secure the method regardless of who's calling it. I could imagine scenarios where even friendly developers call methods accidentally without making sure the code path has the right to perform privileged functions.