Asp.net MVC Secure Area

tags:

asp.net-mvc

views:

answers:

Asp.net MVC Secure Area

I'm just strating a new project in MVC and I need to have a backend that has restricted access.

I was going to set up a group in Active Directory for users who have access rights and use the Authorize atribute on the backend controller to restrict access. I will also enable Windows authentication.

I was just wondering if that would be secure enough for an external facing website for a small to Medium site?

Thanks

Jemes

I see no reason why not using the built in providers.

Not sure what else to say :)

Pino 2010-01-27 11:01:08

Thanks for your reply.What do you mean by built in providers?

Jemes 2010-01-27 11:09:52

Sorry for delay, Like you've said in your post. Authorize tag, Membership and Role Providers.

Pino 2010-01-28 13:48:43

It should be ok, but but do remember MVC supports RESTful url's do go through this link

http://www.infoq.com/articles/roa-resource-metadata to avoid pages not being accessed by other user's as getting uri is easier in REST.

Ravia 2010-01-27 11:01:46

I know this is pointing out the obvious but depending on the sensitivity of the data you might want to look at running the protected parts of your site under SSL?

Additionally depending on your specific needs you might want to look at using IIS to lock down the folder(s) to a set IP address range?

Kane 2010-01-27 11:04:55

The backend is only being used to add/update certain content on the site. I'm not sure about locking down to IP Address as users will need to be able to update the site from different machines and locations.What would be the benifits of using SSL?

Jemes 2010-01-27 11:25:46

SSL is a common cryptographic protocol which provides security for web applications. http://en.wikipedia.org/wiki/Transport_Layer_Security

Kane 2010-01-27 11:29:17

I assuming that if I did follow the security steps above, a user could still access my views in the backend if they guess the url. Does the Authorize atribute work on Views?

Jemes 2010-01-27 15:55:31

Please edit your own question rather than post an answer to it. Thanks!

Dan Atkinson 2010-01-27 15:58:14

[Authorize] doesn't work on views, but there's a ~\Views\Web.config file that prevents *all* direct access to the Views\ folder and its subdirectories. This file is included in the MVC project template.

Levi 2010-01-27 19:45:48

ansaurus

tags:

views:

answers:

Asp.net MVC Secure Area

related questions