Analysis on ASP. NET authorization Module

ASP. NET authorization modules include FileAuthorizationModule and UrlAuthorizationModule. They also implemented the IHttpModule interface. These modules can determine which ASP. NET authorization module is used based on the authentication type used:

If Windows authentication is used, the FileAuthorizationModule is used during the authorization check;

If the <authorization/> element is provided in web. config, The UrlAuthorizationModule is used. See the following:

 
 

  
  
<authorization> 
  
  
<allow roles ="" users=""/> 
  
  
<deny users=""/> 
  
  
</authorization> 
 
 

FileAuthorizationModule:

If you use Windows authentication, the FileAuthorizationModule is used. This module can handle Authorization events and perform access checks on tokens and target resources of requests provided by IIS. In addition, the system ACL (Access Control List) is used ).

For example, if the requested resource is Default. aspx. The current user is xiaoyang. Then the FileAuthorizationModule will perform an access check to see if xiaoyang has access to Default. aspx read permission. If the Windows User Account has the xiaoyang account and has the access permission, the request is successful. Otherwise, the FileAuthorizationModule sets the Reponse. set StatusCode to 401 (unauthorized), and the request ends.

UrlAuthorizationModule:

Unlike the above processing module, no matter what type of authentication is used, you only need to configure the <authorization/> element in web. config, you need to use the UrlAuthorizationModule module. This module is executed as follows during processing:

(1) Compare the username declared in <authorization/> with HttpContext. User. Identity
(2) Compare the role information declared by <authorization/> with HttpContext. User. IsInRole

If it is successful, you can access the corresponding authorized resources. Otherwise, set Reponse. StatusCode to 401 (unauthorized), and the request ends. The above describes the ASP. NET authorization module.

1. Introduction to ASP. NET Framework
2. Introduction to ASP. NET Applications
3. Processing Methods of ASP. NET framework
4. Analysis on ASP. NET Security Architecture
5. Overview ASP. net mvc and FubuMVC core framework