title: Web.config allow location access for specific user
body: <p>I have a webserver from where users can download files that are specific for each user. To be sure each user can only download its own files they must authenticate via <strong>Basic-Authentication</strong>. So for each user there is a windows-account on the server that has read permissions to the user specific folder.</p>
  
  <p>Now I want to move this functionality to another server. I do not want to create windows accounts for the users but still keep the Basic-Authentication. So I use the <a href="http://custombasicauth.codeplex.com/" rel="noreferrer">Custom Basic Authentication HTTP Module</a> in combination with a <a href="http://www.leastprivilege.com/ASPNETMembershipProviderForWebconfig2ndTry.aspx" rel="noreferrer">Custom MembershipProvider</a> that lets me define users in the web.config.</p>
  
  <p>The authentication works quite fine but after logging in with either <code>jack</code> or <code>jill</code> (see web.config) I'm able to access both locations <code>Dir1</code> and <code>Dir2</code>. This is also the case if I comment out the <code>&lt;allow users="jack" /&gt;</code> part in the location tags.</p>
  
  <p>Additional Info:
  I created a Default.aspx file and added a </p>
  
  <pre><code>&lt;% Response.Write(HTTPContext.Current.User.Identity.Name) %&gt;
  </code></pre>
  
  <p>which returns the correct user name depending on who logged in.</p>
  
  <pre><code>&lt;% Response.Write(HTTPContext.Current.User.Identity.IsAuthenticated) %&gt;
  </code></pre>
  
  <p>returns True.</p>
  
  <p><strong>What do I have to do that only <code>jack</code> is able to access (= download files from) <code>Dir1</code> and only <code>jill</code> is able to access (=download files from) <code>Dir2</code> but not the other way round?</strong></p>
  
  <p>EDIT: I tried to add web.config files for each subdirectories instead of the location tags as mentioned by utkai - with the same result. Every user can access any directory.</p>
  
  <p>Here is my Web.config file:</p>
  
  <pre><code>&lt;configuration&gt;
  &lt;system.webServer&gt;
      &lt;modules&gt;
          &lt;add name="CustomBasicAuthentication" type="LeastPrivilege.CustomBasicAuthentication.CustomBasicAuthenticationModule, LeastPrivilege.CustomBasicAuthenticationModule, Version=1.0.0.0, Culture=neutral, PublicKeyToken=F20DC168DFD54966"/&gt;
      &lt;/modules&gt;
  
      &lt;security&gt;
          &lt;authentication&gt;
              &lt;customBasicAuthentication enabled="true" realm="TEST" providerName="AspNetWebConfigMembershipProvider" cachingEnabled="true" cachingDuration="15" requireSSL="false"/&gt;
          &lt;/authentication&gt;
          &lt;authorization&gt;
              &lt;deny users="?" /&gt;
          &lt;/authorization&gt;
      &lt;/security&gt;
  &lt;/system.webServer&gt;
  
  &lt;system.web&gt;
      &lt;membership defaultProvider="AspNetWebConfigMembershipProvider"&gt;
          &lt;providers&gt;
              &lt;add name="AspNetWebConfigMembershipProvider" type="LeastPrivilege.AspNetSecurity.Samples.WebConfigMembershipProvider, WebConfigMembershipProvider"/&gt;
          &lt;/providers&gt;
      &lt;/membership&gt;
  
      &lt;authentication mode="Forms"&gt;
          &lt;forms&gt;
              &lt;credentials passwordFormat="Clear"&gt;
                  &lt;user name="jack" password="jack"/&gt;
                  &lt;user name="jill" password="jill"/&gt;
              &lt;/credentials&gt;
          &lt;/forms&gt;
      &lt;/authentication&gt;
  
      &lt;authorization&gt;
          &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
  &lt;/system.web&gt;
  
  &lt;location path="Dir1" allowOverride="false"&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;!-- &lt;allow users="jack" /&gt; --&gt;
              &lt;deny users="*" /&gt;
          &lt;/authorization&gt; 
      &lt;/system.web&gt;
  &lt;/location&gt;
  
  &lt;location path="Dir2"  allowOverride="false"&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;!-- &lt;allow users="jill" /&gt; --&gt;
              &lt;deny users="*" /&gt;
          &lt;/authorization&gt; 
      &lt;/system.web&gt;
  &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>