O'Reilly logo

Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB by Stefan Schackow, Bilal Haidar

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

9.4. Site Navigation Security

ASP.NET 2.0 and ASP.NET 3.5 include a set of navigation controls such as Menu and TreeView that work with navigation data. One source of this navigation data is the Site Navigation feature, which makes use of SiteMapProvider(s). There is one concrete implementation of a SiteMapProvider included in ASP.NET called the XmlSiteMapProvider. Its purpose is to parse Xml in a .sitemap file and return this information as a linked set of SiteMapNode instances that controls like the Menu control can then render. The interesting aspect of the Site Navigation feature from a security perspective is that you will likely define navigation data in a .sitemap file that closely mirrors the navigation hierarchy of your site. A potential security mismatch can occur if your navigation UI renders links to pages that normally would be inaccessible to a user. Even though an unauthorized user won't be able to actually run such pages, you may not want to even display inaccessible links in the first place.

The base SiteMapProvider class has support for a feature called security trimming. If security trimming is turned on for a SiteMapProvider, prior to returning a SiteMapNode from a provider method, the SiteMapProvider first checks to see if the URL represented by the SiteMapNode is actually accessible to the current user. You enable security trimming with the securityTrimmingEnabled attribute as shown in the following sample provider definition:

<siteMap> <providers> <clear ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required