title: Only allow localhost to certain page on asp.net
body: <p>I have a page that generates a PDF and then returns it to the user. The functionality to generate the PDF will hit other ASP.NET pages and then render those pages as a PDF.</p>
  
  <p>What I want is to only allow those ASP.NET pages to be accessed locally (by the PDF generator). Therefore blocking direct access will allow only the PDF processing tool to get access to it since it is running locally within the ASP.NET application.</p>
  
  <p>I tried adding an <code>ipSecurity</code> element in the web.config to only allow localhost to get access to those aspx pages. Running all of it locally on my machine while developing works fine, however when I deploy and try to generate a report I get a 403 error.</p>
  
  <p>The page that I am requesting that generates the report is in <code>FolderNameHere/ReportPage.aspx</code>. The function on this page will then call the pages in <code>FolderHere/Code/Report</code> to generate the PDF. The problem is I think when I access `FolderNameHere/ReportPage.aspx, it is passing my IP address to future accesses to the Report folder pages even though the function is running locally. Is there a way I can block direct access to these pages except from locally running functions that are called by non local addresses. Here is my config that unfortunately isn't doing the trick.</p>
  
  <pre><code>&lt;location path="Requisite/Code/Report"&gt; &lt;!-- TODO: Move to WebConfig in Requisite--&gt;
      &lt;system.webServer&gt;
        &lt;security&gt;
          &lt;authentication&gt;
            &lt;anonymousAuthentication enabled="true"/&gt;
          &lt;/authentication&gt;
          &lt;ipSecurity allowUnlisted="false"&gt;
            &lt;clear /&gt;
            &lt;add ipAddress="127.0.0.1" allowed="true"/&gt; &lt;!-- only allow local host --&gt;
          &lt;/ipSecurity&gt;
        &lt;/security&gt;
      &lt;/system.webServer&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="?" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  </code></pre>