6

I am trying to create a custom HttpModule which controls which users can view a site.

I am trying to leverage Windows Authentication to do this.

On an individual page, I would probably do something like this:

if (HttpContext.Current.User.Identity.Name.Contains("jsmith"))
{
    Response.Write("You do not have the correct permissions to view this site.");
    Response.End();
}

But because I want to make this more configurable at the application level, I would like to use an HttpModule.

Here is the start that I have made on the code:

using System;
using System.Web;

public class CustomAuthHttpModule : IHttpModule
{
    public void Dispose() { }

    public void Init(HttpApplication context)
    {
        context.BeginRequest += new EventHandler(OnBeginRequest);
        context.EndRequest += new EventHandler(OnEndRequest);
    }

    void OnBeginRequest(object sender, EventArgs e) { }

    void OnEndRequest(object sender, EventArgs e)
    {
        HttpApplication appObject = (HttpApplication)sender;
        HttpContext contextObject = appObject.Context;

        if (contextObject.User.Identity.Name.Contains("jsmith"))
        {
            contextObject.Response.Clear();
            contextObject.Response.End();
        }
    }
}

I would be fine with using the code I have, if I could put it in the OnBeginRequest() function. But the User property is not created in the HttpContext object until OnEndRequest() runs.

Running the code earlier would prevent the application from doing the extra work of producing this output, since some users are just going to be blocked from access in the end.

Can someone suggest a solution to this - is this happening because my module is running before the Windows Auth module, or what?

... or, maybe there is an easier way to do what I am trying to do with IIS or file system permissions?

vwfreak
  • 369
  • 2
  • 5
  • 18
  • 2
    Is there a reason you dont just let IIS do this for you? Or use the `` features in your web.config? – CodingGorilla Dec 09 '10 at 17:16
  • Can you explain what you mean? I'll look up the features to see what you're talking about there. How would IIS "do this for me"? – vwfreak Dec 09 '10 at 18:07
  • `` ! Awesome. I'd mark this as the answer if it had been one and not a comment. Thanks! – vwfreak Dec 09 '10 at 18:21

3 Answers3

9

You want the AuthenticateRequest event.

AuthenticateRequest event

Community
  • 1
  • 1
BlackICE
  • 8,816
  • 3
  • 53
  • 91
0

Have you tried to implement the method in the global.aspx? OnSessionStart? Besides I would use hasRole or some other group-Property instead of contains and username.

Christian
  • 3,503
  • 1
  • 26
  • 47
  • I understand that you can use the global.asax file. Maybe that is a better solution, but I was trying to understand how HttpModules work. When would you use an HttpModule? – vwfreak Dec 09 '10 at 18:04
  • I get what you're saying about username. That makes sense. – vwfreak Dec 09 '10 at 18:05
  • Not for login, but maybe for accessrights. On this point I have understood you wrong. Or for logging. HttpModules are more like filters. – Christian Dec 09 '10 at 19:16
-1

Why write an http module for this. If this is asp.net web forms then why not simply use built in stuff like LoginView http://msdn.microsoft.com/en-us/library/system.web.ui.webcontrols.loginview.aspx

Ben Robinson
  • 21,601
  • 5
  • 62
  • 79