asked on

Secure website using web.config

I want to secure my web app using web.config.

I've been all over the web and tried it all.

It's time for the experts.

My web.config:

<configuration>

<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />

</system.web>

<connectionStrings>
<add connectionString="data source=174.37.215.82;UID=pfcu;PWD=betterbank;initial catalog=pfcu" providerName="System.Data.SqlClient" name="Sitefinity" />

</connectionStrings>
<system.webServer>
<defaultDocument>
<files>
<add value="RatesSelector.aspx" />
</files>
</defaultDocument>
<security>
<ipSecurity allowUnlisted="false">

<clear />

<add ipAddress="127.0.0.1" allowed="true" />

<add ipAddress="83.116.19.53" allowed="true" />

<add ipAddress="83.116.119.0" subnetMask="255.255.255.0" allowed="true" />

<add ipAddress="83.116.0.0" subnetMask="255.255.0.0" allowed="true" />

<add ipAddress="83.0.0.0" subnetMask="255.0.0.0" allowed="true" />

</ipSecurity>
<authentication>
<basicAuthentication enabled="true" />
</authentication>
</security>
<modules runAllManagedModulesForAllRequests="true" />
</system.webServer>

</configuration>
The error is attached. Is there any other method I can use using c#
Under the gun

Thanks,
Isaac
securityerror.png

Randy Downs

Maybe this will help

You cannot do it in the website web.config only.

If you can use IIS manager: Open IIS Manager, locate the site, click on the folder you want to protect, then click on IP address and Domain Restrinctions.

Also click on "Edit feature settings" in the right Actions panel" to specify actions for unspecified clients (i.e. Deny with Forbidden, or simply Deny With Not Found).

This will generate the right configuration for you.

ASKER CERTIFIED SOLUTION

Bob Learned

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial