Search code examples
asp.netauthorization

ASP.NET authorisation allow "*" vs "?"

If I set an all-users authorization rule e.g. <allow users="*"/> does this also allow anonymous users (ie. ones that haven't logged in) to see the resource?

How about vice-versa - if I allow anonymous users with "?" can all logged in users also see it?

Solution
    1. Yes - * means absolutely anybody.
    2. Yes - ? means anonymous users from which all users "inherit".

    Difference is mentioned in ASP.NET Authorization article.