ASP.NET cannot access non-aspx files without logging in (.js, .html etc)

Question

I started a new solution with a website project and a logic project for all my class files.

I copied the web.config file I use for all my other projects and just changed the database name in the connection string. When I run this project to be debugged, it won't let me access any files until I login. This includes javascript files, html files, css files etc.

On all my other projects the only files which require a login by the user to access are .aspx files and .asmx files. The web.config security settings on all several of my projects are as follows:

<authentication mode="Forms">
    <forms loginUrl="/Default.aspx" name="ADMINAUTH2" cookieless="UseCookies"/>
</authentication>
<authorization>
    <deny users="?"/>
</authorization>

If I set test.htm as my start page, when I run the debugger the url heads straight to: http://localhost:2154/Default.aspx?ReturnUrl=%2ftest.htm

In VS on my solution exporler under script documents that are being loaded, any javascript file is shown as: Default.aspx?ReturnUrl=/Functions.js etc, and css files are not applied.

I have tried creating a new web.config file and only adding my auth properties and connection string but to no avail.

I am utterly confused as this works on all my other projects, just not this latest one!

Answer 1

Have you tried deploying this project to IIS or are you just running it from Visual Studio?

Authentication rules specified in the web.config apply to all files which are processed by the ASP.NET ISAPI filter. By default in IIS this is only things like .aspx and .asmx, etc - as you expect. However, the Visual Studio web server processes everything through ASP.NET, so the authentication rules apply to all files.

On the flip-side, this information can be quite useful when you actually do want to secure static assets in production - do so simply by setting IIS to have ASP.NET process those file extensions.