title: ASP.NET Deny Access to certain pages based on roles
body: <p>I have the following in web.config, but still users without role MAnager or Admin can still access the pAccessData.aspx page.
  The page is stored in directory Users</p>
  
  <pre><code>&lt;location path="Users"  &gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  
    &lt;location path="~/Users/ChangePassword.aspx"  &gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*"  /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  
    &lt;location path="~/Users/pAccessData.aspx"  &gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow roles="Manager,Admin"/&gt;
          &lt;deny users="*" /&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  </code></pre>