I think this is an SF question rather than SO, so hopefully I'll find an answer here...
I have a .Net 4 web application deployed to both Windows 2008/IIS7 (dev server) and Windows 2008R2/IIS7.5 (prod server). This site runs without an issue. We've recently had to add IP restrictions to the site, which is set up as "deny all, allow these". Accessing the site from an IP on the whitelist is fine, but from a denied IP it ends in an application exception. I'd expect the result from the denied IP to be a standard IIS error page for a 403.6 response without the request ever arriving at the site, but it seems the request DOES get to the site. Both servers have many site defined and use hostname based binding.
From the dev box, here's the relevant entry from the applicationHost.config file for my current test (the prod file has allow entries instead of this deny entry):
<location path="OurSite.Web"> <system.webServer> <security> <authentication> <anonymousAuthentication enabled="true" /> </authentication> <ipSecurity allowUnlisted="false"> <add ipAddress="10.1.3.193" allowed="false" /> </ipSecurity> </security> </system.webServer> </location>
And here's the error message:
2013-08-26 10:55:07,229 FATAL OurSite.Web (null)  System.Web.HttpApplication.RaiseOnError(:0) - An unhandled 'NotSupportedException' exception occurred within the application. System.NotSupportedException: There is no session associated with this context. You should ensure that one has been started by specifying the correct domain alias at OurSite.Data.Dao.Session.NHibernateSessionManager.CommitTransaction() at OurSite.Web.HttpModule.AbstractNHibernateSessionModule.CommitAndCloseSession(Object sender, EventArgs e) at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
You can see that the request has made it to the site, but not by the normal means, as the NHibernate session was never created. The application does not specify any custom errors (the custom error section is set to Off.) The failed request log is empty.
If anyone can point out what could be wrong, either with the setup or my understanding of how it works, that'd be very much appreciated!