Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We host a neat little SP 2010 solution, my coworker and I developed, on the net. On the root site, you have some news and a login-webpart. (FBA) For everything else, you need to be logged-in.

So far, so good. The only thing we didn't thought of was, that the "user information list" is on the site, too. We stumbled upon this problem when we found some email-adresses and other information from the list on google!

For now we have forbidden the anonymous access, which works for us just fine, but our boss and some clients who have interest in this project want the "welcome"/login-page back.

Is there some work-around? Like setting the anonymous access on a seperate page only?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You could a a location tag to the web.config, restricting access to logged in (admin) users only.

 <location path="PATHTOUSERINFOLIST">
   <system.web>
     <authorization>
       <allow roles="Admin"/>
       <deny users="?"/>
     </authorization>
   </system.web>
 </location>
share|improve this answer

You can enable lockdown mode to prevent unauthenticated users from accessing list and library pages.

Or, if it is indeed only one page that you want to allow, then you can add the following to your web.config:

<configuration>
  <system.web>
    <authorization>
      <deny users="?" /> 
    </authorization>
  </system.web>
  <location path="your-public-page.aspx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
</configuration>

Make sure if that page accesses any css or images that those are in a location that unauthenticated users have access to as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.