Requiring Authentication to Access Files and Folders

Define separate location sections in the web.config file with unique authorization

settings:

1. <location path="file">

2. <location path="folder">

In the web.config file in Web application's root folder:

<?xml version="1.0" encoding="utf-8" ?>

<configuration>

<system.web>

<authentication mode="Forms">

<forms name=".FormsCookie" loginUrl="Login.aspx" />

</authentication>

<authorization>

<allow users="?,*" />

</authorization>

<compilation defaultLanguage="VB" debug="true" />

</system.web>

<location path="SpecialFile.aspx">

<system.web>

<authorization>

<deny users="?" />

<allow users="*" />

</authorization>

</system.web>

</location>

<location path="SpecialFolder">

<system.web>

<authorization>

<deny users="?" />

<allow users="*" />

</authorization>

</system.web>

</location>

</configuration>

Each sub-folder of the Web application can have its own web.config file that specifies its

authorization settings. Individual files however can only have unique authorization settings

specified with the use of the location section. Note that authentication, unlike

authorization, is an application-wide setting that cannot be overridden for files or

folders.