Programmatically check if page requires authentication based on web.config settings

Question

I would like to know if there is a way to check if a page requies authentication based on the web.config settings. Basically if there is a node like this

  <location path="account">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
  </location>

then I would like to check on any page if it requires authentication or not and to return true if it is under the account directory. Is this possible?

Answer 1

The solution is to create an anonymous identity (principal), and pass it into the CheckUrlAccessForPrincipal method. It will determine if the page is public, or requires authentication.

See code below:

var principal = new GenericPrincipal(new GenericIdentity(String.Empty, String.Empty), new string[]{});
bool requiredAuthentication = UrlAuthorizationModule.CheckUrlAccessForPrincipal(Page.AppRelativeVirtualPath, principal, Request.HttpMethod);

Answer 2

Are you checking the page that the user has requested? Its unlikely as the request will never get to the page. Check the url authorization workflow.

http://www.asp.net/web-forms/tutorials/security/membership/user-based-authorization-cs