ASP.NET 4 Unleashed

Security Concerns with Routes

At this point you might be wondering how the URL routing system integrates with ASP.NET’s declarative, location-based security system. It actually integrates quite well. You might have noticed that in several of the samples in this chapter we have been passing a parameter called checkPhysicalUrlAccess when creating route patterns.

This parameter, when true, tells ASP.NET that it should enforce location-based security after determining which ASPx page to call in response to a given pattern. This means that if you have a pattern that looks like this:

http://my.app.com/blog/2010/01/02

and maps to the following location:

/contentsystem/blogapp/posts.aspx

you can define a <location> element in your web.config to secure ...