ASP.NET login control hijacks my 404

Question

I have implemented the standard Login control and everything works fine.

However when i enter an invalid URL it gets redirected to the Login page.

e.g.

mywebsite.com/xxx correctly gives a 404

but

mywebsite.com/xxx.aspx causes a redirect to the login page

I am using ASP.NET 3.5 on Windows Server 2008.

I have set up the web.config with the following

and also

<httpErrors existingResponse="Replace">
<remove statusCode="403" />
<remove statusCode="404" />
<remove statusCode="500" />
<error statusCode="403" path="/xyz/NoAccess.htm" responseMode="Redirect" />
<error statusCode="404" path="/xyz/FileNotFound.htm" responseMode="Redirect" />
<error statusCode="500" path="/xyz/FileNotFound.htm" responseMode="Redirect" />
</httpErrors>

Authentication is via webforms

<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="~/External/SomeView.aspx"></forms>
</authentication>
<authorization>
<deny users="?"/>
</authorization>

So it seems the login page is hijacking my 404. How do i make http://www.mywebsite.com/xxx.aspx return a 404 instead of redirecting to the login page?

Answer 1

No, the login page is not hijacking the 404 result - but you're returning a 403, on which you have told the authentication module to redirect to the login page.

I don't know enough about the inner workings of the errors configuration section in web.config, but try switching the order around:

  <!-- Notice that the 404 rule is before the 403 rule -->
  <error statusCode="404" path="/xyz/FileNotFound.htm" responseMode="Redirect" />
  <error statusCode="403" path="/xyz/NoAccess.htm" responseMode="Redirect" />
  <error statusCode="500" path="/xyz/FileNotFound.htm" responseMode="Redirect" />

If that doesn't work, change your access rules to allow access to xxx.aspx, by removing

<deny users="?" />

since that requires all users to log in before they can access anything. (? matches any anonymous, that is non-logged-in, user...)

Answer 2

I think you need to make your 404 page accessible to all users - try adding this to your web.config:

<location path="/xyz/FileNotFound.htm">
    <system.web>
      <authorization>
          <allow users="*"/>
      </authorization>
    </system.web>
</location>