.NET Authorization. Does the order or allow and deny elements matter?

Question

I am curious whether the order in which you supply the <allow> and <deny> elements in the element does matter?

score 8 · Accepted Answer · edited May 23 '17 at 12:33

8

Yes, the order matters. This page describes the basic principles: http://msdn.microsoft.com/en-us/library/wce3kxhd.aspx. As per the page, a list of authorization rules is built up from the hierarchy of config files and then the first match wins.

This SO question has a nice example: ASP.NET Forms Auth Allowing access to specific file in subdirectory when all others should be denied

edited May 23 '17 at 12:33

Community

1
1

answered May 31 '12 at 15:37

Ian Gilroy

2,031
16
14

.NET Authorization. Does the order or allow and deny elements matter?

1 Answers1