ASP.NET security overview

Protecting static file types using forms authentication

By default, forms authentication protects only ASPX pages and any other .NET extensions. You can configure forms authentication to protect other static extensions such as .jpg, .gif, .html, .pdf, etc. To do this, map these extensions to aspnet_isapi.dll using IIS Manager as follows:

1. Open IIS Manager. To do so, click Start, click Program Files, point to Administrative Tools, and then click Internet Information Services Manager.

2. Find your application’s virtual folder, and right-click it (your application must be forms authentication-enabled).

3. Click Properties.

4. Click Configuration.

5. On the Mappings tab, click
   Add.

6. In the Executable box, click aspnet_isapi.dll, which will be located in the %windows folder%\Microsoft.NET\Framework\FrameworkVersionfolder.

7. In the Extension box, type your extension (for example, .jpg).

8. Provide at-least “GET” verb.

9. Click to clear the Check that File Existscheck box.

10. Click OK for rest of the dialog boxes.

Protecting classic ASP pages using forms authentication

Protecting classic ASP pages with forms authentication is not supported by design because ASP and ASP.NET use different handlers. However, you can make it work using the help of COM-Interop and Web services.


The following sample should work. This would have been pretty easy using simple COM Interop to call into the FormsAutentication utility functions. However, the functions require an HttpContext, which is only available in an ASP.NET application.

As a workaround, create an ASP.NET Web service that does the forms authentication ticket validation.

1. Use the ASP.NET forms authentication sample from the following article as a place to start:

   301240 How to implement forms-based authentication in your ASP.NET application by using C#.NET
    

2. Create a class that will manually validate a ticket that it is passed, return the forms authentication cookie name that is in use, and return the logon URL (all so that the code can be self-contained with minimum administration required):

   ////////////// start sample code //////////////
   
   //this method validates a ticket passed from ASP
   public bool IsAuthenticated(string rawCookieData)
   {
   if(rawCookieData.Trim().Length <= 0)
   return false;
   
   FormsAuthenticationTicket decryptedTicket;
   
   try
   {
   decryptedTicket = FormsAuthentication.Decrypt(rawCookieData);
   }
   catch
   {
   //log reason for failure or whatever here if you like
   return false;
   }
   
   if (decryptedTicket.Expired)
   return false;
   
   // Optionally you could change the method signature to return
   // the decrypted ticket and then, you can call RenewTicketIfOld
   // and then implement code on the ASP side to update the cookie
   // with the newed ticket.  This would only be necessary if the 
   // ticket has a timeout set (this resets the timeout)
   // see the MSDN docs on FormsAuthentication.RenewTicketIfOld.
   
   return true;
   
   }
   
   // method merely returns the name of the cookie being used
   public string GetCookieName()
   {
   return FormsAuthentication.FormsCookieName.ToString();
   }
   
   // method returns the login url used in the redirect
   // this is trickier since there is no FormsAuth utility function available to 
   return this so we have to manually look at web.config
   private string GetLoginURL() 
   {
   string sConfigPath = Server.MapPath(Request.ApplicationPath) + "\\web.config";
   
   XmlDocument doc = new XmlDocument();
   doc.Load(sConfigPath);
   
   try
   {
   XmlNode xmlNodeForms = 
   doc.SelectSingleNode("configuration/system.web/authentication/forms");
   return xmlNodeForms.Attributes.GetNamedItem("loginUrl").InnerText;
   }
   catch
   {
   throw new System.Exception("error in GetLoginURL()");
   }
   
   }
   
   ////////////// end sample //////////////
   

3. Create another .NET wrapper class that calls this Web service (or create and compile a webproxy class).

4. Use Regasm.exe and Gacutil.exe to make this "wrapper" class callable from ASP via ComInterop.

5. The ASP code would look something like this:

   Set oAuthClass = Server.CreateObject("ASPNETFormsAuth.WrapperClass")
   If Not oAuthClass.IsAuthenticated(Request.Cookies(oAuthClass.GetCookieName)) Then
        Response.Redirect("http://servername/ASPApplicationRoot/" & 
   oAuthClass.GetLoginURL & "?RetrunURL=" & Requset.ServerVariables("URL"))
   End If

For more information on forms authentication, see the following resources:

Forms Authentication Provider

Implement forms-based authentication in an ASP.NET application by using C#.NET

Back to the top