Captcha doesn't work with forms authentication?

Question

Guys I am trying to use MSCaptcha in asp.net website. It is working perfectly but as soon as I add Forms authentication in web.config, the captcha image is not displayed.

Web.config before authentication (Captcha image shows up)

<system.web>
<httpRuntime targetFramework="4.5" />
<authorization>
  <allow users="*" />
</authorization>

 <httpHandlers>
  <add verb="GET" path="CaptchaImage.axd" type="MSCaptcha.captchaImageHandler, MSCaptcha" />
</httpHandlers>
 </system.web>

<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="None" />
</appSettings>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />

  <handlers>
  <add name="MSCaptcha.captchaImageHandler" verb="GET" path="CaptchaImage.axd" type="MSCaptcha.captchaImageHandler, MSCaptcha" resourceType="Unspecified" />
</handlers>     

Web.Config after forms authentication is added (Captcha image doesn't load)

<system.web>
<httpRuntime targetFramework="4.5" />
<authorization>
  <deny users="?" />
  <allow users="*" />
  <allow users="GET" />
</authorization>

 <authentication mode="Forms">
  <forms name=".ASPXFORMSDEMO" loginUrl="Default2.aspx"
  protection="All" path="/" timeout="30" />
</authentication>

 <httpHandlers>
  <add verb="GET" path="CaptchaImage.axd" type="MSCaptcha.captchaImageHandler, MSCaptcha" />
</httpHandlers>
 </system.web>

<appSettings>
<add key="ValidationSettings:UnobtrusiveValidationMode" value="None" />
</appSettings>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />

  <handlers>
  <add name="MSCaptcha.captchaImageHandler" verb="GET" path="CaptchaImage.axd" type="MSCaptcha.captchaImageHandler, MSCaptcha" resourceType="Unspecified" />
</handlers>

Why is forms authentication causing issues for captcha? what should I do?

P.S this web-config file is not complete so it might look confusing.

Answer 1

You need to add LOCATION in your web.config :

<location path="CaptchaImage.axd">
 <system.web>
<authorization>
  <allow users="*">
  </allow>
</authorization>
</system.web>
</location>