IIS 10.0 - AllowAnonymous for one application folder (Controller doesn't work)

Question

My ASP.NET web application is using a Windows Authentication and I just want to enable anonymous users to be able to enter one folder (let's call it "XYZ" ). So in the XYZ I have a web config created by the IIS:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <authentication>
                <windowsAuthentication enabled="false" />
            </authentication>
        </security>
    </system.webServer>
</configuration>

Inside the XYZ I have a HTML page, and entering the URL like:

www.site.com/XYZ/htmlPage.html

It is opening without asking about permissions and everything is good. But when I do the same with my controller action (controller is inside the XYZ of couse), I'm getting the 401 error code.

Controller:

[AllowAnonymous]
public class TestController : Controller
{
    [AllowAnonymous]
    public ActionResult Index()
    {
        return Content("Test content");
    }
}

Routing:

        routes.MapRoute(
            name: "XYZRoute",
            url: "XYZ/{controller}/{action}/{id}",
            defaults: new { controller = "Test", action = "Index", id = UrlParameter.Optional });

No idea where I'm making a mistake

Answer 1

You can add this in your main web.config inside <configuration> section:

<location path="XYZ">
   <system.webServer>
    <security>
        <authentication>
            <windowsAuthentication enabled="false" />
        </authentication>
    </security>
</system.webServer>
</location>

And you can delete remove web config inside XYZ folder