asp.net 4 WebForms由于授权规则而无法访问登录页面

Question

I have a default.aspx page which i want to deny access to anonymous users and in the same folder (root folder) i have Logon.aspx which i obviously want anonymous users to access. I have tried the following as specified on Microsoft's support site but i get 401 when trying to access Logon.aspx:

<system.web>
    <authentication mode="Forms" >
      <forms loginUrl="Logon.aspx" name=".VISITAUTH"></forms>
    </authentication>
    <authorization>
        <deny users ="?" />
    </authorization>
</system.web>
<location path="Logon.aspx">
      <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
      </system.web>
</location>

Does anyone have an idea of what i am missing? My other option is to write some code to handle this in the Application_BeginRequest event in the global.asax but was hoping to do things the way Microsoft tells me to.

Answer 1

What i decided to do instead was to create a folder called admin which contained the entire application and left the logon in the root so the authorization rules only apply to the admin folder. Either Microsoft support is BS or i am missing something.

Note: If anyone out there stumbles across this thread in years to come i will be happy to give you credit for giving me a worthy answer.

Answer 2

I recently started with .Net 4.x / Visual Studio 2015 (upgraded from VS2008) and ran into the same problem when I wanted to add a quick and simple authentication mechanism to a working web application. One of the things that caught my attention was the url rewrite: when entering "Login.aspx" the web address changed to "Login", without the .aspx extension, so I tried a few things and here's a solution:

<system.web>
    <authentication mode="Forms" >
      <forms loginUrl="Logon.aspx" name=".VISITAUTH"></forms>
    </authentication>
    <authorization>
        <deny users ="?" />
    </authorization>
</system.web>
<location path="Logon.aspx">
      <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
      </system.web>
</location>
<location path="Logon">
      <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
      </system.web>
</location>

The second location ("Logon") is a rewrite of the first one ("Logon.aspx") and thus needs the same authorization rules.

In hindsight, it seems logical to me that both paths need to be granted access. Perhaps it's unlogical though that it needs to be done explicitly , while the loginUrl of the forms authentication only mentions the original path.