Click here to Skip to main content
15,886,199 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hello,
I'm experimenting some issues with my web.config authorization configuration. I just want to allow any user to access on the "lost password" and "create account" pages, all other pages need to be authenticated.

I am using Visual Studio 2012 and MVC4.

What I have tried:

Here is what I have in my main web.config file.

XML
<system.web>
    <authentication mode="Forms">
        <forms loginUrl="~/Account/Login" defaultUrl="~/Account/Login" timeout="120" />
    </authentication>
    <authorization> 
        <deny users="?"/>
    </authorization>
</system.web>

<location path="~/Account/Create.cshtml">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
</location>

<location path="~/Account/LostPassword.cshtml">
    <system.web>
        <authorization>
            <allow users="*" />
        </authorization>
    </system.web>
</location>


I've got some links in my login form to go on this 2 pages, these links works fine without this configuration but always redirect me to the login page with it.

Could someone help me on this point?

Thanks in advance and sorry for my english.
Posted
Updated 23-Oct-18 2:34am
Comments
j snooze 22-Oct-18 17:39pm    
I personally put my authorizations at the controller level with the [Authorize] attribute(you can do specific roles there as well, or even on certain actions). I leave it off the account controller where people login/forget password etc...

1 solution

Remove the .cshtml extension from the paths. You need to specify the path of the controller action, not the path of the view.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900