Re: Prevent security bypass

[Adrian Wiesmann <awiesmann () swordlord org>]

> you could convert your webserver into an apache and then use 
> .htaccess-files to protect whole directory-trees.
> this may somehow seem to be a drastic solution, but in fact it's not.
> ;-) SCNR...

This is at least what Gartner said, isn't it? :)

Anyway. Why don't you use the built in NT Authentication within IIS? (Are
your users NT users or checked by your own user/password set?)

You could also tell IIS to parse your HTML as if it were ASP and then just
add your ASP code to those files as an include for minimal work.

There would also be the possibility to add a wrapper around the direct
HTML access in ASP, so your HTML files get read by an ASP file and get
only forwarded to the client after successfull authentication. 

There are most surely also other possibilities, but you would need to
provide further details.

Regards,
Adrian