ASP.NET Site Navigation Providers

By default, ASP.NET site navigation works with an XML file named Web.sitemap, which describes the hierarchy of your Web site. However, you might want to describe information about your site in some other way, such as in a database, or a site-map file that has a different layout than the Web.sitemap file.

How ASP.NET Uses Site Navigation Providers

Like ASP.NET membership, ASP.NET Web parts personalization, and other ASP.NET features, ASP.NET site navigation uses providers to interact with the data store. The default provider reads the Web.sitemap file and creates the SiteMap object directly from the file. The SiteMap object is used by site navigation controls to display a navigation structure to the client, such as the TreeView control, the SiteMapPath control, or a custom control.

If you want to store site-map information in a location other than the site-map file, you can create your own site-map provider and configure your application to call the custom provider. The site-map provider is configured in the Web.config file. When the application runs, ASP.NET will invoke your provider, which can retrieve site-map information as needed. ASP.NET then creates and populates the SiteMapNode objects based on the information that your provider returns. These objects can be programmatically accessed by using the SiteMap class. For more information, see Implementing ASP.NET Site-Map Providers.

Security Note

Implementing a custom site-map provider that stores site-map data in a file with a file name extension other than .sitemap is a potential security risk. By default, ASP.NET is configured to protect files with known file name extensions — such as .sitemap — from being downloaded by a client. To help protect your data, place any custom site-map data files that have a file name extension other than .sitemap in the App_Data folder. For more information, see Securing ASP.NET Site Navigation.

See Also

Tasks

How to: Configure Multiple Site Maps and Site-Map Providers

Concepts

ASP.NET Site Navigation Overview
Securing ASP.NET Site Navigation
Securing Data Access

Other Resources

ASP.NET Application Security in Hosted Environments