Password protecting a page or folder

[TheDave]

I recently upgraded from windows 2000 to windows 2003, and before the upgrade we were using the password protected stats directory set up by our hosts to keep a couple of password protected files in. With the upgrade, even though I asked them about it, they have removed my access to the stats directory. Rather annoying. But they did tell me this:

> We could not create a password protected section for you, though the option of creating an ASP.NET page that requires a log in for the directory you want protected does exist. Setting that up would be custom coding and so I would not be able to assist you with that, though.

I would've thought it would be in the hosting company's interest to oblige to a simple customer request.. guess not. Can anyone here please advise on a fairly secure method for a password protected directory that I can set up? It's not super critical security but there are some site mantenaince tools which could be used to cause temporary disruption - like they could delete a product or add a menu option - nothing a restoration of the backup wouldn't fix, but still not the sort of thing I want to be hassled with.

Also, should I look at changing hosts, or is it really that unreasonable of me to request a password protected directory?

[webdevsf]

Thats a LOT of custom coding for something that can be done in 2 minutes using the IIS manager. I wouldn't recommend it.

At a minimum, ask them if they can disable all web access to the stats directory, and then maybe you can pull your stats using ftp.

If they won't oblige, find a different host. It's totally ridiculous that they won't do this.

[Easy_Coder]

I'd Opt for a new host... my host allows me to manage my own user accounts and permissions by directory per account. All via a web interface.

It sounds like your host doesn't have the facility in place to allow you to manage user accounts so therefore they are unwilling to manage it for you via email requests.

I don't want to drop the url because I think it's against the terms of the forum. Sticky me and I can let you know who I use if your interested.

[delboy1978uk]

I've been training using the book Dreamweaver MX and Databases and it tells you how to go about securing a directory for a databse. I Use XP so it could be slightly different to set up on your local machine
but the book uses IIS and ASP.NET

First, you need to turn off Simple File Sharing, so that you have more control over your folders.

Open My Computer choose Tools > Folder Options, goto advanced settings, uncheck Simple File Sharing

Then click on your websites subfolder you want to Secure

Oh yeah, I take it you have installed the ASP.NET framework redistributable from the microsoft site

Right Click and properties
Click on the new Security tab, which wasn't there till you disabled simple file sharing

You can add users and groups through this
There is an IUSR for internet users you should give access to the folders you want with this.

Also you can go into IIS and alter passwords etc in there.

You may need to faff around to get the settings you want, but I am surprised that your host hasn't got a nice simple 'Stick a password on this folder' option

I allow IUSR access to a database folder that contains usernames, passwords, and whether they are allowed to edit pages in my content management system or not. However you need to muck around with session variables and all that, and it aint just a case of click here there and ok

probably still left you confused , but you should look into these options and find out more (or change host and email a letter of disgust)

Del

[TheDave]

Actually I have the email of disgust sitting in my drafts folder ;) I think I'll send it today.

edit- sent! Easy_coder please sticky me the name of your host ;) Thanks