Directories within an ASP.NET website can be made secure, requiring user login, through the addition of authentication to the web.config file.
To add the authentication to the directory /admin, for named users: userA and userB, add an AUTHENTICATION section to teh web.config file.
Within the <authentication> section add:
- A forms tag with name, time out, the type of protection and a file defined for the login.
- A credentials tag defining the type of password to be shown
- for each name to be used an entry is given defining the user name and password.
The complete authentication section is as shown below:
<authentication mode="Forms">
<forms name="appNameAuth" timeout="60" protection="All" loginUrl="/admin/login.aspx" path="/admin">
<credentials passwordFormat="Clear">
<user name="userA" password="passwordA" />
<user name="userB" password="passwordB" />
</credentials>
</forms>
</authentication>
A web.config file can be included within each directory to ensure the authentication.
Alternatively it is possible to include the properties for either directories or files in the web.config file in the root directory using the <location> tag.
<location path="/admin">
<system.web>
<authentication>
<forms name="appNameAuth" timeout="60" protection="All" loginUrl="/admin/login.aspx" path="/admin">
<credentials passwordFormat="Clear">
<user name="userA" password="passwordA" />
<user name="userB" password="passwordB" />
</credentials>
</forms>
</authentication>
</system.web>
</location>
<location path="/bin">
<system.web>
<authentication>
<forms name="appNameAuth" timeout="60" protection="All" loginUrl="/admin/login.aspx" path="/admin">
<credentials passwordFormat="Clear">
<user name="userA" password="passwordA" />
<user name="userB" password="passwordB" />
</credentials>
</forms>
</authentication>
</system.web>
</location>
