Click here to Skip to main content
13,345,954 members (56,190 online)
Click here to Skip to main content
Add your own
alternative version


28 bookmarked
Posted 15 Sep 2004

Restricting Access to trace.axd using IIS Basic Authentication

, 15 Sep 2004
Rate this:
Please Sign up or sign in to vote.
A technique to use the IIS Basic Authentication mechanism to control access to trace.axd.


When using the Basic Authentication method of IIS, you end up generally placing all restricted content within one folder, and all non-restricted content elsewhere. But what if you need to restrict access to a particular type of file, or to a URL request that has no physical file to change the IIS security settings on, such as trace.axd, without having all users logged in, but still use IIS to perform the authentication.

This could be achieved by writing your own HttpModule that handles all requests, and perform the Basic Authentication yourself. However, with a few configuration settings changes and a small amount of code, the same effect can be achieved a lot easier.


Step 1

The first step is to set your main application to use the Forms Authentication.

   <authentication mode="Forms" >
    <forms loginUrl = "Authentication\Login.aspx" name=".ASPNETFRM"/>

The Forms Authentication will only force a user to login if a particular resource has been denied to them. As we are not specifying an authorization section, all users will have access to all resources.

Step 2

To restrict access for trace.axd to only those users who are authenticated, we need to add in a location tag to the web.config file.

  <location path="trace.xsd">
      <deny users="?"/>

Step 3

Off the root of your web site, create a new web application called Authentication. This is the folder where ASP.NET will redirect the users who need to be authenticated. It should match the first part of the loginUrl attribute that you added to the forms element in step 1.

With IIS, change the security settings of this folder, remove anonymous Digest and Windows authentication, and enable Basic.

Step 4

Within the Authentication folder, create a file called Login.aspx. This file name should match the last part of the loginUrl attribute. It will contain the code that maps the Windows authentication to the ASP.NET forms based application.

Within Login.aspx, copy the following code:

<%@ Page language="c#" AutoEventWireup="true" 

                     Inherits="System.Web.UI.Page" %>
<%@ Import Namespace="System.Web.Security" %>
<%@ Import Namespace="System.Configuration" %>
<SCRIPT language="C#" runat="server">
    private void Page_Load(Object Src, EventArgs e ) 
        string user = HttpContext.Current.User.Identity.Name;

        FormsAuthenticationTicket ticket = 
                  new FormsAuthenticationTicket( user, false, 30 );
        string encTicket = FormsAuthentication.Encrypt(ticket);

                      new HttpCookie( 
                          encTicket ) );
                    FormsAuthentication.GetRedirectUrl( user, false ) );

When the Page Load event runs, the code grabs the name of the current user from the HttpContext. A new FormsAuthenticationTicket is created and then this is returned to the user in a cookie. The cookie name must be the same name that was defined in the web.config.

The users who will be authenticating will need valid NTFS permission to access both the Authentication folder and the Login.aspx page. You do not have to restrict the access to these files, just ensure that all users are able to reach them.

Step 5

Within the Authentication folder, create a new web.config file. Within this file, we need to add the application settings value for the cookie that is picked up in Login.aspx, and we need to bind ASP.NET to the IIS Authentication to ensure that the User property of the HttpContext is populated with the details of the user authenticating against IIS.

    <add key="AuthCookie" value=".ASPNETFRM"/>
    <authentication mode="Windows"/>

Step 6

Finally, the default behavior for Form Authentication is that each application within a web site will receive its own unique encryption key that is used to encrypt the cookie value. Because we need the cookie created within the Authentication application to be valid across all other applications in the web site, we need to switch off this behavior.

Within the web.config file of the root application, add the additional entry:

  <machineKey validationKey="AutoGenerate"



Now, try and access the trace.axd output. If everything is setup correctly, you will be asked to login before the data is sent back to you.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Web Developer
United Kingdom United Kingdom
No Biography provided

You may also be interested in...


Comments and Discussions

GeneralDoesn't work Pin
djsdjsdjsdjs8-Feb-05 6:32
memberdjsdjsdjsdjs8-Feb-05 6:32 
GeneralNice! Pin
Figuerres21-Sep-04 10:15
memberFiguerres21-Sep-04 10:15 
GeneralRe: Nice! Pin
ChrisAdams21-Sep-04 10:19
memberChrisAdams21-Sep-04 10:19 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

Permalink | Advertise | Privacy | Terms of Use | Mobile
Web01 | 2.8.180111.1 | Last Updated 15 Sep 2004
Article Copyright 2004 by ChrisAdams
Everything else Copyright © CodeProject, 1999-2018
Layout: fixed | fluid