Web.config

WEB.CONFIG file in a web application

• Allow / Deny users

Below code will deny access to the anonymous users and Windows users with a Guests Role. However, the user yyyy under xxx domain will be granted access.


allow users="xxx\yyyy">
deny users="?">
deny roles="Guests">

• WARNING!

allow users="*">
deny users="yyyy">


Due to the design of .NET, the above will grant access to all authenticated users even though yyyy seems to be denied!

• When WEB.CONFIG is updated (even with an insignificant change, like addition of a space character)

-The entire web application will be forced to restart This is an enhancement over .NET 1.1
-What if, I don't want my application to restart each time an update is made to WEB.CONFIG in .NET 2.0?
Solution: Create another configuration file like easy.config and put the most frequently changing setting in this file.

appsettings configsource="easy.config">

Good practice: Create a seperate config file for Connection Strings.

Adding a key & value pair in WEB.CONFIG:

appSettings>
add key="x" value="5"/>
/appSettings>

• Publishing the site locally:

This is also an enhancement in .NET 2.0. Whenever we publish the site locally, the .NET framework creates a .dll and the .aspx files for our access.
This is especially useful if we don't have IIS (Internet Information Services) installed.
We can easily debug our web application in our local PC.

• Reconfiguration of ASP.NET: (a real-time problem)
  

In some instances, we may need to reconfigure ASP.NET.
(For example, if the IIS was installed later than ASP.NET.)

run the ASP.NET reconfiguration utility:

> aspnet_regiis.exe -u (for uninstallation)
> aspnet_regiis.exe -i (for installation)

• BONUS knowledge for IIS:

Suppose that somebody is continuously trying to access your ftp site.
The person is not granted access but the bandwidth will be used unwantedly.
I can get the IP address of this unwanted internet user by checking my log file. And I want to block this IP addresss from my ftp site.
IIS can not do this! (Even though it can not, it is good to know :) )
However, this IP-denial can be achieved in proxy-level. HOW??