Multiple paths in location element of web.config

Question

How can I specify multiple paths in one location element in web.config?

<location path="Images">
    <system.web>
        <authorization>
            <allow users="?" />
        </authorization>
    </system.web>
</location>

We would like to add styles and images to location, e.g. <location path="images, styles">.

Is it possible to put multiple paths in location element (and how would I do that)?

Solution 1

You cannot do this unless they share the same root folder. I've been known to dump images/styles/javascript into a single folder like "_res" or "_system" and authorize that folder

More info on the location element: http://msdn.microsoft.com/en-us/library/b6x6shw7(v=vs.71).aspx

On the path attribute:

Specifies the resource that the contained configuration settings apply to. Using location with a missing path attribute applies the configuration settings to the current directory and all child directories. If location is used with no path attribute and allowOverride is False, configuration settings cannot be altered by Web.config files that are in child directories.

Solution 2

You must use one location element for each location that you want to control access to. The path can be a directory, which will make the rules apply to everything in that directory.

Comments

[Triynko]

Sharing the same root folder and applying permissions just to that folder seems like a good idea. So I just created a "public" folder, authorized anonymous users to access it, then dumped my css, images, etc. folders into it. They used to all be in the root, so their relative location to one another doesn't change (i.e. the relative image paths in the css files are still valid), so I just update my html documents to point to the public/css folder instead of the css folder.

[Rich O'Kelly]

The link to the location element on MSDN no longer works, I think it should be msdn.microsoft.com/en-us/library/b6x6shw7(v=vs.100).aspx

[hunter]

updated the link, thanks! Dropped the .aspx because it doesn't seem to matter