newbie: allow deny vs deny allow

  • Thread starter Thread starter Jeff
  • Start date Start date
J

Jeff

asp.net 2.0 security:

Below are 2 authorization blocks. I wonder what is the difference between
them from a security point of view?

I guess this can be a standard question on a asp.net 2.0 certification exam,
so i'm very interested to know the difference between these settings.

<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>

<authorization>
<allow users="*"/>
<deny users="?"/>
</authorization>
 
There should be nothing different because of the ordering. In each case, you
are saying allow all, but deny by ensuring a person has an account.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************************************************
Think outside of the box!
*************************************************
 
Back
Top