IIS Keeps Redirecting to Login.aspx when I set Default.aspx as default page

Question

IIS Keeps Redirecting me to Login.aspx when I set Default.aspx as default page. In my dev environment its working fine, I get to the right page, but as soon as I publish and try from the IIS server login.aspx always comes first.

I have made sure anon users are allowed :

  <location path="Default.aspx">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>

And its set as default url (further down the config) :

<authentication mode="Forms">
  <forms loginUrl="Login.aspx" defaultUrl="Default.aspx"></forms>
</authentication>
<authorization>
  <deny users="?" />
</authorization>

I even set the default page in IIS, but it resets it every time on publish.

Answer 1

Try adding the Authenticated User to the security property of the web folder in IIS. Give the modify privilege (Read, Write, Modify, List Folder Content, Read & execute) to this user.

This of course should only be a temporary situation to verify that you have a permission issue. You should consider setting proper permissions for site users.

//Peace

Answer 2

I spent about 6 hours debugging the issue. Our website was working fine, and suddenly it started redirecting to login page instead of default page (unauthenticated). Our web.config included all authentication/authorization settings correctly.

    <authentication mode="Forms">
      <forms name="MyAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30" />
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>

  <system.webServer>
    <defaultDocument>
      <files>
        <clear />
        <add value="default.htm" />
      </files>
    </defaultDocument>
...
  </system.webServer>

  <location path="default.htm">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>

...

SOLUTION: You need to remove Extensionless URL feature from your website. Ref: https://support.microsoft.com/en-us/help/2526854/users-may-be-redirected-to-the-login-page-of-an-asp-net-4-application

<system.webServer>

     <handlers>
          <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
          <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
          <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
     </handlers>

     <validation validateIntegratedModeConfiguration="false" />

</system.webServer>

After the fix, the website was back to normal.