Autherisation in web page

Joby Chacko

18y6.6k.NET

Hi Experts,

I have an application with different roles like admin, arbitrator, aprover, users etc. If the user directly type a URL of the page i dont want to allow them to enter. So what i did was I gave in web.config . But after enter into the application, if he type a url of page5.aspx directly, i dont allow him to show that page. I am not sure whether he is allowed to see page5.aspx. His role may allow or may not allow him. How do i achieve this?

Is there any property which allow me to enter into Page5.asp only through another page's redirection, instead of directly typing through url.

Please give me a solution in detail.

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Nipun Tomar18y ago
Accepted answer
<configuration>
<location path="page1.aspx">
    <system.web>
      <authorization>

        <allow roles="arbitrator" />
        <deny users="?"/>
      authorization>
    system.web>
location>
<location path="page2.aspx">
    <system.web>
      <authorization>
       Page2 is accessible only for aprover-->
        <allow roles="aprover" />
        <deny users="?"/>
      authorization>
    system.web>
location>
<location path="page3.aspx">
    <system.web>
      <authorization>
       Page3 is accessible for all-->
       <allow users="?" />
      authorization>
    system.web>
location>
configuration>
you can do the same for page6 as for page1 if access roles are same
Joby Chacko18y ago
Thank you Mr.Nipun Tomar.
Joby Chacko18y ago
Dear Mr.Nipun Tomar,

Thanks for the reply. I really apreciate it.

Could you please clarify it once again. How do i restrict page1 for particular roles and Page2 for particular roles? What i mean is Page1 is accessible only for Arbitrator role, and page2 for aprover and page3 for all users. And if same role can access more than one page. That is Arbitrator can access Page1,Page6.

Regards

Joby
Nipun Tomar18y ago
you can use authorization in web.config for the pages you want restricted access

<configuration>

<system.web>

    <authorization>



      <allow roles="admin, arbitrator, aprover"/>

      <deny users="?"/>

    authorization>

system.web>

<location path="page1.aspx">

    <system.web>

      <authorization>

        <allow users="?" />

      authorization>

    system.web>

location>

<location path="page2.aspx">

    <system.web>

      <authorization>

        <allow users="?" />

      authorization>

    system.web>

location>
configuration>