title: Asp.Net Authentication Module
body: <p>I have created an authentication module in ASP.Net but I do not want the logic in the authentication module to be executed if the resource is configured for anonymous access since the logic is expensive.</p>
  
  <p>There are pages that require authentication in the same directory with pages that do not require authentication. I have no control over this. Is there an easy way to determine that a resource is configured to allow anonymous access prior to the URLAuthorizationModule? </p>
  
  <p>Currently, I am doing the following which does "feel" right. Any help would be appreciated.</p>
  
  <pre><code>public static bool AllowEveryone()
          {
              bool rslt = false;
  
              AuthorizationSection config = (AuthorizationSection)WebConfigurationManager.GetSection("system.web/authorization");
              if (config.Rules != null &amp;&amp; config.Rules.Count &gt; 0)
              {
  
                  AuthorizationRule r = config.Rules[0];  //doing this based on implementation of urlauthorization module in reflector...
                  if (r.Action == AuthorizationRuleAction.Allow &amp;&amp; r.Users.Contains("*"))
                  {
                      return true;
                  }
  
                  //todo: check for allow anon ? case
  
  
              }
  
              return rslt;
          }
  </code></pre>