How to restrict access to a folder with routing rules?

Question

I want to resctrict access to folder called Authenticated by adding this rule to the root Web.config

<location path="Authenticated">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>

The rule work properly only when I don't use the routing rule. I need your help to understand how make this work with routing rule enabled.

By exemple, the rule work on this url: ../locahost/Authenticated/CarList.aspx and don't work with routing: ../localhost/en-us/car-list.aspx

I also add a Web.config the Authenticated folder root and I get the same result.

Thank you for your help!

Edit

This is the code that sets up the route

 Public Shared Function GetUrlByRoute(session As HttpSessionState, pageName As String, routeName As String, Optional dictionary As Dictionary(Of String, Object) = Nothing, Optional setLanguage As String = "") As String
        Dim parameters As RouteValueDictionary
        Dim vpd As VirtualPathData
        Dim nextLanguage As String = "fr-ca"
        Dim currentLanguage As String = "fr-ca"

        If dictionary Is Nothing Then
            dictionary = New Dictionary(Of String, Object)
        Else
            If dictionary.ContainsKey("pageName") = True Then
                'Remove the old page name to set the new requested page name for hyperlink
                dictionary.Remove("pageName")
            End If
            If dictionary.ContainsKey("language") = True Then
                'Just in case
                dictionary.Remove("language")
            End If
        End If

        dictionary.Add("pageName", pageName)

        UrlHelper.GetUrlLangage(session, False, nextLanguage, currentLanguage)
        'Set the switch language link to next language lnkEnglish
        If setLanguage IsNot String.Empty Then
            dictionary.Add("language", setLanguage)
        Else
            dictionary.Add("language", currentLanguage)
        End If

        parameters = New RouteValueDictionary(dictionary)
        vpd = RouteTable.Routes.GetVirtualPath(HttpContext.Current.Request.RequestContext, routeName, parameters)
        Return vpd.VirtualPath

    End Function

Global asax

Sub RegisterRoutes(ByVal routes As RouteCollection)

        routes.Add("Page", New Route("{language}/{pageName}", New UrlRoutingHandlers()))
        routes.Add("Account", New Route("{language}/{pageName}/{id}", New UrlRoutingHandlers1()))

    End Sub

UrlHandler

Public Function GetHttpHandler(ByVal context As System.Web.Routing.RequestContext) As System.Web.IHttpHandler Implements System.Web.Routing.IRouteHandler.GetHttpHandler
    Dim language As String = context.RouteData.Values("language").ToString().ToLower()
    Dim pageName As String = context.RouteData.Values("pageName").ToString()

    Dim oUtilisateurConferance As Data.DataView = vwRouteMappingURL.Where("FriendlyPageName = '" + pageName + "'")

    For Each oRow As DataRowView In oUtilisateurConferance
        Return TryCast(BuildManager.CreateInstanceFromVirtualPath(oRow("VirtualPath").ToString(), GetType(Page)), Page)
    Next

    Return Nothing

End Function

I meant the code that says `Routes.Add(...)` or similar, but what you've added might still be relevant also. — Damien_The_Unbeliever, Jan 30 '14 at 15:41
Yeah, so there's a [`PageRouteHandler`](http://msdn.microsoft.com/en-us/library/system.web.routing.pageroutehandler(v=vs.110).aspx) that has specific constructors/properties that indicate that it applies authorization checks based on the resulting physical path - but you don't seem to be using it. — Damien_The_Unbeliever, Jan 30 '14 at 15:50
let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/46456/discussion-between-karine-and-damien-the-unbeliever) — Karine, Jan 30 '14 at 18:57

How to restrict access to a folder with routing rules?

0 Answers0