开发者

location element for web.config security when path is is empty "" and not "."

I'm using one of the nightly resharper builds and recently I just came across it pointing out this message "Location element is unusued: path is empty" given the following web.config code

 <location path="">开发者_运维技巧;
    <system.web>
      <authorization>
        <allow roles="Administrator" />
        <deny users="*" />
      </authorization>
    </system.web>
  </location>

I find this statement from resharper to be dubious being that I have used location elements like this without issue.

Is the blank path just defaulting it to "." as the MSDN says is the default value of the path property?

Making <location path=""> and <location path="."> functionally equivalent?


The default value for path is "." only when you don't override it; this, <location> is functionally equivalent to <location path="."> - but <location path=""> is different. A blank path though isn't supposed to get used; if it ever gets used, that's very likely a bug in the way .net treats empty paths.


This error is surely another example of Resharper's over-zealousness. Microsoft advise to use a blank path in the breaking changes for ASP.NET 4.

However according to MSDN,

Using location with a missing path attribute applies the configuration settings to the current directory and all child directories.

so you can possibly just omit the path attribute, which prevents the Resharper error.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜