Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an ASP.NET application with Forms Authentication enabled, deployed to an IIS 7 server. In the web.config file I have added <location> sections to exclude the default documents (index.html/default.aspx) from authentication.

If I navigate directory to http://mysite.com/default.aspx, it works as expected. It doesn't ask for authentication. However, if I navigate to http://mysite.com/, it always redirects to the forms authentication login page.

I have the default document setup in IIS as default.aspx, but it will always redirect if I don't include the default.aspx page in the URL.

Is there any way to allow prevent the redirect to the login page if a user is navigating to just the 'root' site?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

The location tags can target specific files and subfolders but can't target the root (i.e. /). One option is to start with all allowed and block files and folders. The problem there is that if you forget to do this for new folders your site can be vulnerable.

I believe that you can use URL Rewrite to handle the default doc and point to default.aspx with a 'rewrite' rule. For example, in the url match, use "^$" which means exactly nothing. Then for the action, rewrite to /default.aspx. Then .NET will see /default.aspx and won't redirect for you.

share|improve this answer
    
That is what I ended up implementing in the short term. I am executing a RewritePath command in the Application_BeginRequest routine of Global.asax. It is working, but in the back of my mind it doesn't seem like I should have to do this. –  Tim Cochran Sep 2 '11 at 11:30
    
The other option is to separate the project so that the root folder allows anonymous access but certain subfolders require authentication. For example, put all authenticated content in a /admin folder. The other advantage is that your images, css, js and other content won't fight with you for anonymous pages. –  Scott Forsyth - MVP Sep 2 '11 at 14:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.