Is it possible to configure a location in Web.config to only allow local connections

Question

Hi All,

I've got a page in an ASP.Net app (its Mvc actually but not important) and I would like to only allow connections to this page from the local machine. I would love to do something like this in Web.config:

<location path="resources"><system.web><authorization><allow ips="local"/></authorization></system.web></location>  

I know this is possible with a simple check in the page code behind (or controller) and its even possible just with IIS configuration but I would love a Web.config config as this would be the most elegant solution in my opinion. Anyone know if this is possible?

Thanks

Guido

Answer 1

This isn't what you asked for, but you could specify users of  the local machine. I can't imagine this is practical unless it's a small number of users you're wanting to authorize.

<location path="resources">
  <system.web>
    <authorization>
      <allow users="LOCALMACHINENAME\UsernameOfTrustedUser"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

Answer 2

You could create your own configuration section that would be part of your web.config and then use the setting to control the behavior in global.asax Session_Start.

Answer 3

Here is a link to a solution with a HttpModule.

Answer 4

Run the site on a port other than 80, then access like this: http://localhost:1943 where 1943 is the new port number. Simple, quick, will also block calls to non .net content eg images.

Answer 5

1. Invent a non-DNS alias for the machine, i.e. "PrivateHostName".
2. Set this value in the local hosts file to point to 127.0.0.1.
3. Set a (IIS) host header for the web site such that it only responds to requests to address "PrivateHostName".
4. For all local calls use the private host name.

Remote clients will not be able to resolve the host name.

You could secure it more using a dedicated ip address tied to a virtual network adapter which would not actually respond to external requests.