|
Hi,
I'm having a problem setting up web.config to challenge for authentication on some pages, but not others.
Here is what I'm doing:
<configuration>
...
<system.web>
...
<authentication mode="Windows" />
<authorization>
<allow users="*"/>
</authorization>
...
</system.web>
<location path="server/local" allowOverride="false">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
</configuration>
I.e. i'd like to allow all users on all pages, except on all pages below the server/local directory, where I'd like IIS to challenge anonymous users for authentication. The odd thing is that this only seems to work if the parent directory of 'local', i.e. 'server' exists on disk.
The thing is, that I'm working with a custom IHttpHandler that generates pages dynamically, and uses the path to pages to decide which pages to create (not ideal, maybe, but it's something I haven't got control over). That is, neither the 'server' nor the 'local' directory exist on disk, and so pages are returned without challenge. If I manually create the directories, I suddenly get the login challenge.
So, my question is, am I doing something wrong, or is it a bug. Or is this how it's supposed to work, and if so, is there a work around?
Cheers,
Tilman
|
|
|
|
|
Hi all, I have an interest to attend for online classes with free of cost regarding asp.net, c#, vs2005, sqlserver. which are conducted by Microsoft in weekends in various cities. But i dont know the source how to attend for this?
Where i have to register for this?
Can any one knows, let me know.
I am staying at Hyderabad, Andhra Pradesh, India.
I am not knowing whether this is a correct Place to post this Message or Not ? if Not, Sorry for this post.
G. Satish
|
|
|
|
|
Hi
Has any1 come across some good articles comparing sql inline and stored procedures?
I have searched google but can only find forums where this is discussed, no actual articles
thanks 
|
|
|
|
|
comparing what exactly? ease of coding? efficiency? speed?
|
|
|
|
|
Security ideally, I've seen a lot of posts in forums suggesting that inline sql isnt as secure as stored procedures
|
|
|
|
|
The term you need to google for is "sql injection[^]" as this is what makes inline sql insecure.
|
|
|
|
|
Hi,
My session is expired near about after 10 seconds.
I am using Firefox.
About Cookie Manager What should I Do for that. Should I clear the Cookies first or other solution for session not to expired.
Thanks
|
|
|
|
|
set sessionstate timeout in web.config file
|
|
|
|
|
Thanks for the information.
I am setting the session timeout period in the virtual directory.
that is set to 60 min.
One solution that you told to write into the webconfig.
Is there any other solution that related to the virtual directory.
Thanks
|
|
|
|
|
SO you have set the session timeout in IIS in virtual directory to 60 min yeah?
and this is not working correct?
|
|
|
|
|
Yes you r right.
Session is Expired within 5-10 mins.
|
|
|
|
|
Then I think there is something in your code which is over writing the virtual directory session timeout
How come you dont use the solution in the post above to put the sessiojn timeout in web config
|
|
|
|
|
I you are using forms you should check
<br />
<authentication mode="Forms"><br />
<forms timeout="1024" /><br />
</authentication><br />
also if you didn't do it yet.
<br />
<system.web><br />
<sessionstate timeout="1440" mode="InProc" /><br />
</system.web><br />
|
|
|
|
|
The user sign in to my website without sign out enter into another site (type address in address bar). For this situation I want to logout my website. How to do this? I am using ASP.NET 2.0 with C#
|
|
|
|
|
I don't think there is an easy way to do this as there would be no way of running a bit of code to detect this
|
|
|
|
|
There are a few ways that you could go about doing this, each with their own set of trade-offs. The first couple that come to mind for me are:
Use the built-in ASP.NET session management and force your logout code to run when the session expires (see the Session_End handler in global.asax. The default session expiration is a 20 minute sliding timer from the last request/response activity. This number can be tuned to your liking, but remember that it will effect a user that leaves their browser idle as well as one that actively browsed away from your site.
Another possibility is to use a session-based cookie (reference[^]) to signify that a user has logged into your site and use the unload event of the window object (reference[^]) in client script to force your logout code to run. The downside here is that you would be logging the user out each time they navigated from page-to-page, even within your site and you would have to read the cookie to verify that they're authenticated to your site and run your login code each time. The result is rather messy, as your login and logout code are running for each page of your site. The user would also be able to leave your site and return still authenticated until they closed their browser.
My recommendation would be to consider the first technique of using the built-in session. Unless you have extremely sensitive content or logout code that absolutely must run immediately, I find that the session is usually a good trade-off.
Hope that helps a bit to get you started. 
--Jesse "... the internet's just a big porn library with some useful articles stuck in." - Rob Rodi
|
|
|
|
|
Hi All,
Can someone please tell me what is the exact difference between ASP.NET 2003, 2005, 2008.
I know that in 2005 partial class is added and in 2008 we can build style sheet, but I want to know more. Like, is there any change in .NET framework or any other important difference.
Thanks in advance...
|
|
|
|
|
Please read this[^].
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
hi friends
how to get referal url in c#?
please tell me
|
|
|
|
|
Request.UrlReferrer
Hope that helps.
--Jesse "... the internet's just a big porn library with some useful articles stuck in." - Rob Rodi
|
|
|
|
|
Request.UrlReferrer
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
hi
in my project for a particular page, i want to block the anonymous users from viewing that page for three times only. how can i do it? please help me.
thanks
mukesh.
|
|
|
|
|
You could do it with cookies, just store a cookie to say how often they have visited. Of course, delete the cookie and they get three more visits.
Christian Graus
Please read this if you don't understand the answer I've given you
"also I don't think "TranslateOneToTwoBillion OneHundredAndFortySevenMillion FourHundredAndEightyThreeThousand SixHundredAndFortySeven()" is a very good choice for a function name" - SpacixOne ( offering help to someone who really needed it ) ( spaces added for the benefit of people running at < 1280x1024 )
|
|
|
|
|
You could also do it by IP. The downside whould be that if some users are behind a proxy than you'll have a maximum 3 hits for all the users behind that proxy .
|
|
|
|
|
Hi..
I am new to asp.net..
I want run some client side applications from my asp.net web application using activeX controls..
I didnt find much on google about this..
Does anyone know how to do it?
Som
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
