location tags for Forms authentication

[tonymathewt]

If I am having hundreds of pages in my application and the user given the provision for adding new roles and assigning roles allowed or denied for locations. Considering page level security then it would end up in creating hundreds of location tags in the web.config file. And each tag should contain all the roles either in the allow or deny attribute. Is this the normal way of establishing security in such an application? And writing to web.config restarts the application. After each modification or creation of a role we have to restart the application to make the updation take effect. Then what would be the best session state management policy considering the above scenario?