ASP.NET MVC using IIS6: Block access to single view (register)

Question

We are using MVC on IIS6. Our site is currently being opened up, but we need to restrict access to the register part of the site, but allow those who can register (i.e. from within our offices) still to sign in and use the site fully.

So inside office can access register and all other site. Outside office cannot access register and but can access all other site.

Initially, we put file restrictions for the IPs of our offices on the register.aspx file in the views\accounts folder. We were pretty sure this was working, but today, we discover it isn't! Which thinking about it actually makes sense!

So is this possible?

We need to have the other aspx pages in the views\accounts folder usable as views whilst only blocking the register view.

Hope this makes sense!

Neil

Answer 1

Urls defined with ASP.NET MVC are configurable and not based on the folder or file where view page resides. This means that you cannot use IIS to configure the access for this view pages. You can filter access to the controllers (and so indirectly the view pages that are called by the view pages). This is done with Action Filtering. On how to create a custom action filter see this page.

So yes, it is possible to limit access to certain pages depending on the ip-address.

Answer 2

I have come across this kind of situation before, but the problem was solved by the way we write applications.

Whenever we've had an application with "some information displayed" and "a way to administer the data" we've always created separate UI projects over the top of the business logic. This isn't just to help with maintainability, it also means that the public bit can be deployed on a public website, while the admin bit can be accessed over the network - so there is no external access at all.

In your example, extracting out the two logical elements would mean that you can deploy two separate web projects with different access rules in IIS.

Another option would be to check the IP address in the executed code for the restricted page - IP addresses can be spoofed, so it's not a completely secure solution.