Restrict access to a subdomain with web.config on IIS7?

Question

I need to password protect a "dev" subdomain on a server with the web.config file on IIS7. I don't have access to anything besides the files and web.config, so I can't install modules or anything else like that sadly. I've checked about 6 other answers and none of them seem to work for what I need, or at all for that matter.

The subdomain is not a subfolder of the root domain, the folder containing the subdomain is a sibling of the root domain, so it's like "account/domain.com" and "account/dev.domain.com".

I don't care if it uses a password or IP address or cookie or whatever, I just want to protect the domain so only I can view it while I'm developing on it.

Sorry for the slow reply, the server-side language being used is ASP (VBScript, not ASP.net). — Brett, Jul 31 '17 at 08:15

score 0 · Answer 1 · answered Jul 31 '17 at 08:22

I was able to secure the subdomain by creating a separate web.config file residing in the web root of the subdomain (which physically exists as a subdirectory within the root domain). I assume this solution would work for subdomains as well as basic subdirectories of a domain.

Within the web.config file I added the following. I've removed the extraneous/unrelated directives removed for clarity but wanted to show the full xml structure of the web.config file:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>      
            <authentication>      
                <anonymousAuthentication enabled="false" />      
                <basicAuthentication enabled="true" />           
            </authentication>      
        </security>
    </system.webServer>
</configuration>

The important part was adding the two authentication directives within the authentication section (which resides within configuration > system.webServer > security).

Note that this method requires me to use my main "server" login provided by the hosting service, and I was not able to manually specify a username and password to be used.

If you need to quickly secure a subdirectory or subdomain on an IIS7 server though, this should do the trick. I believe the credentials you'd need to use are the ones you use to access the FTP server, though I'm not sure if those are the same as the "hosting control panel" credentials for everyone or just for my host.

Restrict access to a subdomain with web.config on IIS7?

1 Answers1