Blocking hyperlink access to 'secured' website

microsoft.public.dotnet.security

15 Feb 2006 12:11 AM

rjcmbc

Hello,

We deployed an intranet web application on a Windows Server 2000 with
ASP.net 1.1. The application accepts connections via Integrated Windows
authentication from users in a defined NT security group. The Anonymous
access is disabled including the anonymous userid.

This works well when users (with permission) access the app via the 'front
door' so to speak (i.e. default URL) however, users without permission appear
to be able to access the application via a 'back door' (i.e. directory
hyperlink) if they are sent the link from someone who has access (though not
related in any way of course).

My question is obvious, how can we establish security on all directory
levels?

Thanks in advance for any insight.

rjcmbc