允许IIS 7.5通过ASP.NET管道提供静态文件

Question

I have few folders which are to be excluded from blocking like Content, Javascript and Scripts in web.config. Please help me achieve this.

Here is the config:

<location path="TechDocs">
<system.web>
  <authorization>
    <deny users="?" />
  </authorization>
</system.web>
</location>
<location path="Scripts">
<system.web>
  <authentication mode="None" />
  <authorization>
    <allow users="*" />
  </authorization>
  </system.web>
</location>
<location path="Content">
<system.web>
  <authentication mode="None" />
  <authorization>
    <allow users="*" />
  </authorization>
</system.web>
</location>
 <location path="Javascript">
<system.web>
  <authentication mode="None" />
  <authorization>
    <allow users="*" />
  </authorization>
</system.web>
</location>

Answer 1

This is what we use

    <location path="Scripts">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <location path="Css">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

You have to ensure that you do not have a httpmodule that intercepts the requests and sends out 401 Unauthorized for any of the above resources

The following is my routing configuration so that MVC does not accidentally route the requests to MVC, which you can apply either

            routes.IgnoreRoute("{*allaspx}", new { allaspx = @".*\.aspx(/.*)?" });
            routes.IgnoreRoute("{*staticfile}", new { staticfile = @".*\.(ico|css|js|gif|jpg|woff|eot|svg|eot|ttf|otf)(/.*)?" });

            routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
            routes.IgnoreRoute("{resource}.wdgt/{*pathInfo}");
            routes.IgnoreRoute("ChartImg.axd/{*pathInfo}");
            routes.Ignore("{*pathInfo}", new { pathInfo = @"^.*(ChartImg.axd)$" });
            routes.IgnoreRoute("{resource}.svc");

Answer 2

I don't think you can do that.

The general rule of thumb with anything from Microsoft is that Deny always beats Allow, so if you're denying access at the root level, then you're not going to be able to grant access at a lower level unless you can remove the permissions inherited from the root level. I don't think there's a way to remove those inherited permissions. I tried putting under but that isn't valid.

So you have to set the deny all users on each folder that needs to have access denied, you can't have it default to deny. Also, maybe you shouldn't have tons of content in an IIS site if that content is denied to all users?