Does web.config only govern .aspx files?

[jefreywith1f]

I have a directory that I want to restrict to members only. Members names &
passwords are held in an SQL table. I've named the members_only directory as an
application in IIS manager. I've built login & logout pages and everything
seems work OK, but the URLs of PDFs and plain HTML files within the directory
are accessible without logging in. Does the web.config file only govern the
..NET bits of the site and ignore other files like PDF & HTML? The
web.config file for the members directory is as follows <configuration>
<system.web> <authorization> <allow users='member' />
<deny users='*' /> </authorization> </system.web>
</configuration> System.web from the web.config at the root of the site
<system.web> <customErrors mode='Off' /> <authentication mode =
'Forms'> <forms name = 'SECAUTH '
loginUrl='/members/members_only/member_login.aspx'> <credentials />
</forms> </authentication> <authorization>
<allow users='*' /> </authorization> </system.web>

[Paul Whitham TMM]

I am afraid so as it is relevant only to the ASP.Net process, and this is
only envoked with a .aspx page.

--
Regards

Paul Whitham
Macromedia Certified Professional for Dreamweaver MX2004
Valleybiz Internet Design
[url]www.valleybiz.net[/url]

Team Macromedia Volunteer for Ultradev/Dreamweaver MX
[url]www.macromedia.com/support/forums/team_macromedia[/url]

"jefreywith1f" <webforumsuser@macromedia.com> wrote in message
news:cvkvqd$gk$1@forums.macromedia.com...

> I have a directory that I want to restrict to members only. Members names

&amp;

> passwords are held in an SQL table. I've named the members_only directory

as an

> application in IIS manager. I've built login &amp; logout pages and

everything

> seems work OK, but the URLs of PDFs and plain HTML files within the

directory

> are accessible without logging in. Does the web.config file only govern

the

> .NET bits of the site and ignore other files like PDF &amp; HTML? The
> web.config file for the members directory is as follows

<configuration>

> <system.web> <authorization> <allow users='member' />
> <deny users='*' /> </authorization> </system.web>
> </configuration> System.web from the web.config at the root of the site
> <system.web> <customErrors mode='Off' /> <authentication

mode =

> 'Forms'> <forms name = 'SECAUTH '
> loginUrl='/members/members_only/member_login.aspx'>

<credentials />

> </forms> </authentication> <authorization>
> <allow users='*' /> </authorization> </system.web>
>

[jefreywith1f]

Thanks for the answer. I'll have to look into another method of authorization.

Geoff