I have an ASP.NET application with Forms Authentication enabled, deployed to an IIS 7 server. In the web.config file I have added <location> sections to exclude the default documents (index.html/default.aspx) from authentication.

If I navigate directory to http://mysite.com/default.aspx, it works as expected. It doesn't ask for authentication. However, if I navigate to http://mysite.com/, it always redirects to the forms authentication login page.

I have the default document setup in IIS as default.aspx, but it will always redirect if I don't include the default.aspx page in the URL.

Is there any way to allow prevent the redirect to the login page if a user is navigating to just the 'root' site?

1 Answer 1


The location tags can target specific files and subfolders but can't target the root (i.e. /). One option is to start with all allowed and block files and folders. The problem there is that if you forget to do this for new folders your site can be vulnerable.

I believe that you can use URL Rewrite to handle the default doc and point to default.aspx with a 'rewrite' rule. For example, in the url match, use "^$" which means exactly nothing. Then for the action, rewrite to /default.aspx. Then .NET will see /default.aspx and won't redirect for you.

  • That is what I ended up implementing in the short term. I am executing a RewritePath command in the Application_BeginRequest routine of Global.asax. It is working, but in the back of my mind it doesn't seem like I should have to do this. Sep 2, 2011 at 11:30
  • The other option is to separate the project so that the root folder allows anonymous access but certain subfolders require authentication. For example, put all authenticated content in a /admin folder. The other advantage is that your images, css, js and other content won't fight with you for anonymous pages. Sep 2, 2011 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.