Windows "forms" authentication - <deny users="?"> redirecting to foreign page!

Question

Like the title states - I have a web.config file that looks like,

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.web>
    <compilation debug="true" targetFramework="4.0" />
    <authentication mode="Forms">
         <forms name="login" protection="All" timeout="30" loginUrl="login" defaultUrl="~/">
              <credentials passwordFormat="Clear">
                   <user name="admin" password="password" /> 
              </credentials>
         </forms>
        </authentication>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

I want to do exactly what it says it should do... I want to deny all users who try to enter the site.

It works however, it redirects to a "Account/Login?ReturnUrl=%2flogin" url I have never heard of...

Is there a place I can change this?

Answer 1

The problem is

loginUrl="login"

This is the URL to send unauthenticated users to. If the URL to your login page is "Login.aspx" then thats what you should set it too.

loginUrl="login.aspx"

The piece at the end, ReturnURL, is the address to redirect the user to if they successfully login.