I really hope this isn't a duplicate, but I wasn't able to find anything like this on here.

My issue is: I have a subdirectory on a Windows (not sure if 2008 R2 or 2012) server with IIS 8.5 that I want to protect with basic authentication. I've talked to the server admin and he activated basic auth for me and added a Windows user for me. The protection works, but only for directories, not individual files.

This leads to bizarre situations like "sub.domain.com/subsubdir/" is only accessible with the correct user/password combination, but "sub.domain.com/subsubdir/index.php" is open for all to visit, and I can't figure out why. The way I've implemented this in the web.config is this:

<location path="dir/subdir">  
            <allow users="authorizedUser"/>
            <deny users ="?" />    

Where the subdomain points to "dir/subdir", thus "sub.domain.com/subsubdir/" to reach the subdirectory.

I tried dir/subdir/ and dir/subdir/*, but both lead to errors. Either I'm using the wrong keywords, or Google doesn't know about my problem.

I'm not even sure if that's something I have to fix on my side (only access via FTP) or if it's some Windows setting that the admin has to change. Does anyone know what's happening here?

Edit: I got confused with my own subdirectories and forgot a level. Not sure if that's relevant, but I edited it anyway.

  • So if you have closed all your browser sessions, and surf directory to /subdir/file.php, it displays it without prompt?
    – MichelZ
    May 21 '14 at 14:27
  • Exactly. I even used several different browsers to be sure there's no cache involved.
    – Christian
    May 21 '14 at 14:33
  • Has your admin disabled anonymous authentication?
    – MichelZ
    May 21 '14 at 14:36
  • As far as I know, he didn't. Is that necessary?
    – Christian
    May 21 '14 at 14:37
  • Yes, that's usually how you do that if you require auth for the whole application / directory
    – MichelZ
    May 21 '14 at 14:37

You should disable anonymous authentication for the directory if there is no need to have anonymous users. This will take care of the problem

  • Thanks for the help. I'll try that and come back here as soon as I have results.
    – Christian
    May 21 '14 at 14:57
  • Seems like I won't be able to test this anytime soon because of unrelated things, but I trust your answer enough to accept it anyway. Thanks for the help!
    – Christian
    Jun 10 '14 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.