I have remove ACL rights of users but they still have access to my views

Question

I hope someone has an idea what's happening in my project. I have an issue with security. It's a MVC 3 web application with Areas. I have remove access to a group of users through ACL. However, they are still able to see the view through a Web browser. Important to note that they don't have access to css and js that are in ~/content/*.

I have run procmon and I see the request and the user correspond to the application pool user. I think it is in my web.config. I have one at the root of the application and one in the area. Here they are : Here's the web.config at the root :

<configuration>
    <system.web>

    <httpRuntime maxRequestLength="100000" executionTimeout="300" />
    <compilation debug="true" targetFramework="4.0">
      <assemblies>
        <add assembly="System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add assembly="System.Web.Helpers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add assembly="System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add assembly="System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add assembly="System.Web.WebPages, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
      </assemblies>
    </compilation>

    <authentication mode="Windows" />

    <authorization>
      <deny users="?" />
    </authorization>

    <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider">
      <providers>
        <clear/>
        <add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
      </providers>
    </roleManager>


    <pages>
      <namespaces>
        <add namespace="System.Web.Helpers" />
        <add namespace="System.Web.Mvc" />
        <add namespace="System.Web.Mvc.Ajax" />
        <add namespace="System.Web.Mvc.Html" />
        <add namespace="System.Web.Routing" />
        <add namespace="System.Web.WebPages"/>
      </namespaces>
    </pages>

    <customErrors mode="Off" defaultRedirect="~/Erreur/ErreurTechnique">
      <error statusCode="401" redirect="~/Erreur/AccesRefuse"></error>
      <error statusCode="404" redirect="~/Erreur/PageIntrouvable"></error>
      <error statusCode="500" redirect="~/Erreur/ErreurTechnique"></error>
    </customErrors>

  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false"/>
    <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>

  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding>
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="None"/>
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
  </system.serviceModel>
</configuration>

Here's the web.config in the area under views :

  <system.web.webPages.razor>
    <host factoryType="System.Web.Mvc.MvcWebRazorHostFactory, System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
    <pages pageBaseType="System.Web.Mvc.WebViewPage">
      <namespaces>
        <add namespace="System.Web.Mvc" />
        <add namespace="System.Web.Mvc.Ajax" />
        <add namespace="System.Web.Mvc.Html" />
        <add namespace="System.Web.Routing" />
      </namespaces>
    </pages>
  </system.web.webPages.razor>

  <appSettings>
    <add key="webpages:Enabled" value="false" />
  </appSettings>

  <system.web>
    <httpHandlers>
      <add path="*" verb="*" type="System.Web.HttpNotFoundHandler"/>
    </httpHandlers>

    <!--
        Enabling request validation in view pages would cause validation to occur
        after the input has already been processed by the controller. By default
        MVC performs request validation before a controller processes the input.
        To change this behavior apply the ValidateInputAttribute to a
        controller or action.
    -->
    <pages
        validateRequest="false"
        pageParserFilterType="System.Web.Mvc.ViewTypeParserFilter, System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
        pageBaseType="System.Web.Mvc.ViewPage, System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"
        userControlBaseType="System.Web.Mvc.ViewUserControl, System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
      <controls>
        <add assembly="System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" namespace="System.Web.Mvc" tagPrefix="mvc" />
      </controls>
    </pages>
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <handlers>
      <remove name="BlockViewHandler"/>
      <add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
    </handlers>
  </system.webServer>
</configuration>

Any idea anyone?

How are you determining what roles are allowed to access what views/actions? I see you have deny all anonymous users in the root `web.config`, but nothing beyond that. — Steven V, Apr 18 '13 at 20:54
*Never - Ever* use the `web.config` to lock down an MVC application. Possible duplicate of [How to lock down paths in ASP.NET MVC?](http://stackoverflow.com/questions/11765030/how-to-lock-down-paths-in-asp-net-mvc-4) — Erik Philips, Apr 18 '13 at 21:08
I did not used the AuthorizeAttribute in my controller to determine access to views/actions. I wanted to allow only a group of user through ACL security. Users that are not allowed get access denied for all .css and .js but the view is showing in browser. That's pretty weird but should I understand that this is normal? — Mathieu G, Apr 19 '13 at 13:10
The raw view in Razor format, or the actual run-time view of `/controller/action`? — Erik Philips, Apr 19 '13 at 18:05
the actuel run-time view (but without style and js because the content files return 401 - not authorized as expected) — Mathieu G, Apr 19 '13 at 18:07

score 0 · Answer 1 · answered Apr 19 '13 at 19:41

Take a look at Securing your ASP.NET MVC App and the new AllowAnonymous Attribute.

You cannot use routing, web.config files or ACL to secure your MVC application (Any Version). The only supported way to secure your MVC application is to apply the Authorize attribute...

Quote

MVC uses routes and does not map URLs to physical file locations like WebForms, PHP and traditional web servers. Therefore using web.config or ACLs will definitely open a security hole in your site.

The product team will have a communication if this changes in the future, but for now it is without exception the rule.

I have remove ACL rights of users but they still have access to my views

1 Answers1