title: How to password protect a image directory with a web.config
body: <p>How would I set a directory to where only authenticated users could access the files?</p>
  
  <p>In other words I need to make sure that only people that are logged in can access the images and other person data with a web.config.</p>
  
  <p>What are the settings?</p>
  
  <p>Here is what I've got so far but it does not stop users that are not logged.</p>
  
  <pre><code>    &lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <hr>
  
  <p>My web.config file with most of the information removed. If you could place that configuration info where it goes so that no one that is on my site can access a folder called users unless they are logged on.</p>
  
  <pre><code>    &lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;!--
    For more information on how to configure your ASP.NET application, please visit
    http://go.microsoft.com/fwlink/?LinkId=169433
    --&gt;
  &lt;configuration&gt;
    &lt;connectionStrings configSource="cnn.config" /&gt;
    &lt;appSettings configSource="app.config" /&gt;
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime requestValidationMode="4.5" targetFramework="4.5" encoderType="System.Web.Security.AntiXss.AntiXssEncoder, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /&gt;
      &lt;machineKey compatibilityMode="Framework45" /&gt;
      &lt;authentication configSource="authentication.config" /&gt;
      &lt;pages&gt;
        &lt;namespaces&gt;
          &lt;add namespace="System.Web.Helpers" /&gt;
          &lt;add namespace="System.Web.Mvc" /&gt;
          &lt;add namespace="System.Web.Mvc.Ajax" /&gt;
          &lt;add namespace="System.Web.Mvc.Html" /&gt;
          &lt;add namespace="System.Web.Optimization" /&gt;
          &lt;add namespace="System.Web.Routing" /&gt;
          &lt;add namespace="System.Web.WebPages" /&gt;
        &lt;/namespaces&gt;
      &lt;controls&gt;
          &lt;add tagPrefix="ajaxToolkit" assembly="AjaxControlToolkit" namespace="AjaxControlToolkit" /&gt;
        &lt;/controls&gt;
      &lt;/pages&gt;
      &lt;membership configSource="membership.config" /&gt;
      &lt;roleManager configSource="roles.config" /&gt;
      &lt;profile configSource="profile.config" /&gt;
        &lt;!--&lt;sessionState mode="InProc" customProvider="DefaultSessionProvider"&gt;
        &lt;providers&gt;
          &lt;add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="DefaultConnection" /&gt;
        &lt;/providers&gt;
      &lt;/sessionState&gt;--&gt;
    &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>