有权访问register.aspx但被重定向到登录页面的匿名用户

Question

Trying to restrict anonymous users to login.aspx, register.aspx and Site.css files and authenticated to have access to whole site. Currently anonymous can access login.aspx and Site.css as styles appearing correctly. However when I click on register.aspx link I get redirected to login.aspx page.

Below my web.config in web root. There are no other web.configs in directory structure. I don't know if I should be looking anywhere else (I know WSAT can sometimes hold rules but not sure if superseded by root Web.config).

Was just thinking login and register files reference a master page would this need explicit authorization as well? Although wouldn't explain why login works for anonymous but register doesn't.

Thanks for your help! Anthony.

<?xml version="1.0"?>

<configuration>
  <connectionStrings>
    <add name="************"
         connectionString="Data Source=**********; Initial Catalog=************; Integrated Security=SSPI; Persist Security Info=False; Trusted_Connection=Yes"
         providerName="System.Data.SqlClient" />
  </connectionStrings>

  <location path="Register.aspx">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>

  <location path="Login.aspx">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>

  <location path="Site.css">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>

  <system.web>
    <compilation debug="true" targetFramework="4.0" />

    <authentication mode="Forms">
      <forms loginUrl="~/Website/Login.aspx" timeout="2880" />
    </authentication>

    <authorization>
      <deny users="?"/>
    </authorization>

    <membership>
      <providers>
        <clear/>
        <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices"
             enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
             maxInvalidPasswordAttempts="5" minRequiredPasswordLength="8" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
             applicationName="***********" />
      </providers>
    </membership>

    <profile>
      <providers>
        <clear/>
        <add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="**********" applicationName="/"/>
      </providers>
    </profile>

    <roleManager enabled="false">
      <providers>
        <clear/>
        <add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="***********" applicationName="/" />
        <add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
      </providers>
    </roleManager>
  </system.web>

  <system.webServer>
     <modules runAllManagedModulesForAllRequests="true"/>
  </system.webServer>
</configuration>

Answer 1

This code will allow only anonymous users: (pay attention to the added deny node after the allow!

<location path="Register.aspx">
    <system.web>
      <authorization>
        <allow users="?"/>
        <deny users="*" />
      </authorization>
    </system.web>
  </location>

Answer 2

Try changing the paths to include ~/Website, the same as your forms authentication login location. You wont need the login page specifed as by default it allows access as it is the LoginUrl in your formsauthentication setup.

  <location path="~/Website/Register.aspx">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>

  <location path="~/Website/Login.aspx">
    <system.web>
      <authorization>
        <allow users="?"/>
      </authorization>
    </system.web>
  </location>