Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a web-app that basically catches all requests for url-rewriting purposes, except for a certain sub directory (/static) which has it's own web.config (NOT a subapplication!), which defines a StaticFileModule for all files.

However, since it is the same HttpApplication, all events are still fired for these requests, including OnAuthenticateRequest which is kind of problematic for us.

I wonder if there is anything I can configure in web.config to make it bypass the event-chain, or certain events in the chain (I have been looking into to no avail), or completely detach the sub directory from the root application (preferably without configuring the sub directory as an application)?

As of now I have use a special case in my OnAuthenticateRequest in order to bypass it, but I would like to contain it into the sub directory itself (not needing to maintain code in order to have static directories).

This might belong on stackoverflow as well.

share|improve this question

In the web.config for your /static directory, in the system.webServer/modules/ XML path, you should be able to drop your authentication module for just the /static directory using a "remove" element as explained in this document.

share|improve this answer
Thank you for your answer, however the OnAuthenticateRequest event is not part of a module, but directly in our GlobalApplication. – jishi May 10 '11 at 20:25
Could you move the code into a separate module, allowing you to control when it's used via the web.config? – Mason G. Zhwiti May 11 '11 at 23:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.