Security Trimming in SiteMaps

May 2, 2006 · 1 min read

Security Trimming attribute in the SiteMap is a pretty cool feature to hide the links which are not approachable by the user of the desired role. Yes, I think "NOT APPROACHABLE" is the correct word as most of the people think about security trimming feature in a different way (THE WRONG WAY).

Check out the Web.config settings of the Site Map below:

 <siteMap defaultProvider="XmlSiteMapProvider" enabled="true">                <add name="XmlSiteMapProvider" type="System.Web.XmlSiteMapProvider"              siteMapFile="Web.siteMap" securityTrimmingEnabled="true"/>                               

As, you can see above that securityTrimmingEnabled is set to true which will enable the security trimming on the sitemap nodes.

Here is the Web.sitemap file:

  

    <siteMapNode siteMapFile = "/SomeFolder/Header.sitemap"/>     <siteMapNode siteMapFile ="/SomeFolder/Footer.sitemap" />

  

Now, take a look at the Footer.sitemap since that contains the roles attribute.

<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >

  <siteMapNode url="/PostMenu.aspx" title="root">     <siteMapNode url="/UserPages/AddNewReply.aspx" title="Reply" />         <siteMapNode url="~/Admin/ApprovePosts.aspx"     title="Delete" roles="Admin" />   

The bold line above represents that the node"~/Admin/ApprovePosts.aspx" should only be visible to Admin and not all the users. This also means that your Admin folder should only be accessed by Admin and not anyone else. For that check out the web.config authorization section below:

<location path="Admin">         <system.web>                              **<allow roles="Admin"/> **                <deny roles="Developer"/>         <deny roles="User"/>                      </system.web>     

So, basically what sitemap enableSecurityTrimming does is it goes to the path and see if the path is approachable if so, then it displays it else it won't display. 

This article is part of the GWB Archives. Original Author: Mohammad Azam

New on Geeks with Blogs

  • We Won The One Award I Actually Care About

    Full Scale made the Inc. 5000 for the fifth year straight, the 12th listing across my three companies. Here is why the one award you cannot buy is worth stopping for.

  • Your Customers Build the Features Now

    I let a tool I liked sit dead for a year rather than build the features I wanted. An MCP server meant I never had to, and your customers can do the same to your product.

  • Get the Size of a Directory in Linux the Easy Way

    du -sh for the quick answer, ncdu for the cleanup, df for the disk itself: every command for checking directory size in Linux, plus why du and df never agree.

  • Vim Search and Replace: The Ultimate Guide

    One :%s command replaces every match in a file before a find dialog would even open. The Vim substitute patterns worth the muscle memory: flags, ranges, capture groups, and multi-file edits.