Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ASP.NET application with Forms Authentication enabled, deployed to an IIS 7 server. In the web.config file I have added <location> sections to exclude the default documents (index.html/default.aspx) from authentication.

If I navigate directory to, it works as expected. It doesn't ask for authentication. However, if I navigate to, it always redirects to the forms authentication login page.

I have the default document setup in IIS as default.aspx, but it will always redirect if I don't include the default.aspx page in the URL.

Is there any way to allow prevent the redirect to the login page if a user is navigating to just the 'root' site?

share|improve this question
up vote 0 down vote accepted

The location tags can target specific files and subfolders but can't target the root (i.e. /). One option is to start with all allowed and block files and folders. The problem there is that if you forget to do this for new folders your site can be vulnerable.

I believe that you can use URL Rewrite to handle the default doc and point to default.aspx with a 'rewrite' rule. For example, in the url match, use "^$" which means exactly nothing. Then for the action, rewrite to /default.aspx. Then .NET will see /default.aspx and won't redirect for you.

share|improve this answer
That is what I ended up implementing in the short term. I am executing a RewritePath command in the Application_BeginRequest routine of Global.asax. It is working, but in the back of my mind it doesn't seem like I should have to do this. – Tim Cochran Sep 2 '11 at 11:30
The other option is to separate the project so that the root folder allows anonymous access but certain subfolders require authentication. For example, put all authenticated content in a /admin folder. The other advantage is that your images, css, js and other content won't fight with you for anonymous pages. – Scott Forsyth - MVP Sep 2 '11 at 14:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.