9.4. Site Navigation Security
ASP.NET 2.0 and ASP.NET 3.5 include a set of navigation controls such as Menu and TreeView that work with navigation data. One source of this navigation data is the Site Navigation feature, which makes use of SiteMapProvider(s). There is one concrete implementation of a SiteMapProvider included in ASP.NET called the XmlSiteMapProvider. Its purpose is to parse Xml in a .sitemap file and return this information as a linked set of SiteMapNode instances that controls like the Menu control can then render. The interesting aspect of the Site Navigation feature from a security perspective is that you will likely define navigation data in a .sitemap file that closely mirrors the navigation hierarchy of your site. A potential security mismatch can occur if your navigation UI renders links to pages that normally would be inaccessible to a user. Even though an unauthorized user won't be able to actually run such pages, you may not want to even display inaccessible links in the first place.
The base SiteMapProvider class has support for a feature called security trimming. If security trimming is turned on for a SiteMapProvider, prior to returning a SiteMapNode from a provider method, the SiteMapProvider first checks to see if the URL represented by the SiteMapNode is actually accessible to the current user. You enable security trimming with the securityTrimmingEnabled attribute as shown in the following sample provider definition:
<siteMap> <providers> <clear ...
