ASP.NET configuration file specifies the root directory:

In [not login can also access the directory path] in a configuration file in the web. Config:

 
<? The XML version="1.0" encoding="utf-8"?> 
 
 
 
 

Has successfully launched the directory browsing, enter in your browser: http://xxxx/login can not access the directory path/
You can see all the files in the directory (including web. Config),

Now, I hope only login a User (such as HttpContext. Current. User. Identity. The Name="admin") is visible, other users are not allowed to directory browsing,
But through concrete path (such as: http://xxxx/login can not access the directory path/open. Aspx),
. Don't login (HttpContext. Current. The User Identity. The Name is empty)
Can also access, can be achieved?