Getting User.Identity is Forms using FormsAuthentication in ASP.NET 4.5

Question

I am using FormAuthencation in my current web application with ASP.NET 4.5. I have placed a check on Login page if (User.Identity.IsAuthenticated){ } then redirect to main page , but strange without even login i am getting User.Identity.IsAuthenticated = true i do not understand why that giving true.

Web.Config

<authentication mode="Forms">
      <forms loginUrl="~/Account/Login.aspx" name=".ASPNETAUTH" defaultUrl="~/Account/Welcome.aspx" protection="All" timeout="30" path="/"></forms>
    </authentication>

Thanks Ravi Mittal

Answer 1

If this is published in IIS, you need to disable anonymous access via IIS (you can see how to do that on this page).

It would also help to make sure the <authorization> section of your web.config has something like this:

<authorization>
    <deny users="?"/>
</authorization>

This will block "unauthorized" users from your app.