I have a PHP site (Default Web Site) and an ASP.NET site (application under the Default Web Site) running together.

I have set up Windows Authentication for the Default Web Site and it's fine. The problem is my ASP.NET application creates a web request - (HttpWebRequest)WebRequest.Create(url) - to pull in information from the PHP application. It's fine without authentication but with Windows Authentication it gets a (401) Unauthorized response.

I figured out I can pass credentials with request.Credentials = new NetworkCredentials(user, pwd, domain); but I'm really looking for a way for the PHP application allow the other application on the same server (site even) through.

How can I tell the Default Web Site to allow these requests?


I don't think you can bypass the IIS authentication. After all, this is what it is for :)

What you could do is setup the PHP website twice, once with authentication, and once without.

On the site without authentication, make sure you set IP Restrictions, to only allow localhost requests

| improve this answer | |
  • worked brilliant thanks. Set up new Web Site pointing to the same root , set binding to, set IP Address and Domain Restrictions to deny from all and allow from, changed WebRequest code to use as the host in the request url – DaveO May 29 '12 at 6:40

Just remove the Windows Authentication from the Default Website, and set it on your application under the default website.

This is of course assuming that you don't need authentication on the default website (PHP)

| improve this answer | |
  • I do need the authentication for both, but I need the application to bypass it so it can get content from the PHP site, either by through settings in IIS or passing authentication (when required) when it makes the request. – DaveO May 25 '12 at 11:47

Create a duplicate (called e.g. x_internal.php) of the php page (or pages) that you want to access from the .net app and (on those pages only) set them to allow anonymous access and use IP filtering to restrict access to the local IP only to prevent direct access from non local clients.

I've done similar things in the past without issue.

| improve this answer | |
  • Thanks, unfortunately rewrite rules and whatnot made the duplicate Web Site solution much easier. – DaveO May 29 '12 at 6:41

This looks a lot like an issue caused by Microsoft closing a security vulnerability.

If it is the same issue I have seen, http://support.microsoft.com/kb/896861 will give you enough details to sort it out. In my case, this was simply a question of editing the registry.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.