Authorization Issue - anonymous users can't access .jpeg or .css

Question

I have this on my web.config file:

<authentication mode="Forms">
      <forms loginUrl="login.aspx" defaultUrl="Venues.aspx" />
    </authentication>
    <authorization>
      <deny users="?" />
      <allow users="*" />
</authorization>

I only want to allow authenticated users to my pages. The problem is, the first time that I go to the login page, I don't have any images or styles on my page. I think this is because I denied access to the .jpeg and .css files. I think I can solve this issue in IIS, but I'm just in Dev. I only have VS 2008 and no IIS.

Is it possible for me to allow access to the imgs dir for the anonymous user in the web.config?

Answer 1

You could allow certain directories (directly under <configuration>):

<location path="images">
    <system.web>
        <authorization>
            <allow users="?"/>
        </authorization>
    </system.web>
</location>

Also you would probably need to include WebResource.axd

<location path="WebResource.axd">
    <system.web>
        <authorization>
            <allow users="?"/>
        </authorization>
    </system.web>
</location>

Answer 2

I think this is a known bug in Visual Studio - when you're not using IIS, visual studio mistakenly blocks the CSS file on the login page.

See here:
blog post from tomtech999

It should be OK when you run in IIS.

Answer 3

Similarly, if you want Microsoft's ReportViewer control to work on your web page, you need to add this:

<location path="Reserved.ReportViewerWebControl.axd">
  <system.web>
    <authorization>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

This was a problem for me while attempting to get the 2010 version of report viewer to work. (Fortunately, it only took 7 billion years to uncover the source of the problem.)