Set ASP.NET Authorization for a sub-directory in web application programmatically

Question

I've got an ASP.NET application that uses the CreateUserWizard to register new users. Part of my registration process is creating a "home directory" for the user where they'll be able to upload files.

I'd like to use the ASP.NET authorization features to restrict access to the "home directory". Only the registered user assigned to the directory should have access.

I think I know how to do this declaritively with Web.config. I can do something like the following:

<?xml version="1.0"?>
<configuration>
.
.
<location path="UserHomeDirectories">
   <system.web>
     <authorization>
       <deny users="?"/>
     </authorization>
   </system.web>
</location>

<location path="UserHomeDirectories/MyUser">
   <system.web>
     <authorization>
       <allow users="MyUser"/>
       <deny users="*"/>
     </authorization>
   </system.web>
</location>
.
.
.

This post almost answers my question, but can someone help me out with my particular situation? One more thing: doesn't modifying the Web.config restart the application? (i.e. when my code in the directory creation/authorization code in my CreatedUser event handler of the CreateUserWizard class is run?)

Thank you for your help!

Answer 1

Instead of using the location attribute in your app-wide web.config, you can place a new one inside the user's folder. In this new file, you specify the authorization rules for that specific folder, and they will override the app-wide rules.

As this does not change your original web.config file, your application will not restart.