How to make ASP.NET MVC View Insecure via location tag in Web.Config

Question

I have the following authorization settings in my web.config:

 <authorization>
      <deny users="?" />
 </authorization>

This deny's all anonymous access to the application accept the login page. In addition to this I am using authorization within each controller action via a custom authorize attribute.

I have one additional action that I would like to expose publicly in addition to the login page. This particular action does not have the authorization attribute on it. I have tried to make this view (resetPassword view) public by using the location tag in the web.config file like so:

 <location path="Account/ResetPassword" allowOverride="false">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

In the path attribute above I have tried both the view as well as the action path, but it doesnt allow public access to the action.

I have even tried to put this view in a separate folder within the shared folder and put a separate web.config file to make that folder public like so:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <allow users="*" />
    </authorization>
  </system.web>
</configuration>

None of the above configuration allow me to make this particular action (view) public. Can anyone suggest any other solutions, or what I may be doing wrong in this case? Thanks in advance.

Answer 1

You can remove the authorization tag from the web config and just use the authorize attribute. The action without the Authorize atttribute set will be public.

I had the same problem some time ago. Please have a look to this question and its answers

If you want to do it using the web config then use code like this

<!-- Allow access to _assets directory -->
<location path="_assets">
    <system.web>
       <authorization>
           <allow users="?"/>
       </authorization>
    </system.web>
</location>

In your sample you are using "*" but you should use "?" ;)