I want to grant default document anonymous access in web.config

Question

I have a site that uses forms authentication site wide, with some pages within as exceptions where they are allowed to be viewed with anonymous access. I want the default doc, index.aspx to be viewable via anonymous access. It grants me access if I specify index.aspx in the url, but if I type in the domain name only, I get redirected to connectionTest.aspx (the login page for the site). I have confirmed that index.aspx is the default doc. So there's something wrong with my web config entry for index.aspx

<authentication mode="Forms">
  <forms name=".ASPXAUTH" loginUrl="connectionTest.aspx" timeout="30" />
</authentication>
<sessionState mode="InProc" cookieless="false" timeout="30" />
<authorization>
  <deny users="?" />
</authorization>
<location path="~/index.aspx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
</location>
<location path="index.aspx">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
</location>

Yes, I just didn't post that part of web.config for brevity, but I added it to the post. And that is why the url with index.aspx specified works, but as default doc, it does not. — user192632, Jun 24 '16 at 13:44

score 0 · Answer 1 · edited May 23 '17 at 12:32

Your issue is come because you did not have declare the domain on the form authentication. Because the authentication is base on cookie and you need to access it with out the www. in front you need to declare it as:

<authentication mode="Forms">
  <forms name=".ASPXAUTH" domain="demo.com" loginUrl="connectionTest.aspx" timeout="30" />
</authentication>

when you set the domain with out the www. in front then all cookies from the domain are the same one, if you do not declare that, then each cookie is depends from the sub-domain and are different - so you logged out.

the same stands and for the cookie it self.

Similar answer : Multiple applications using same login database logging each other out

I added this but it didn't seem to do anything. I'll keep it anyway as it seems like a good idea, but that doesn't appear to be my error — user192632, Jun 24 '16 at 13:48

I want to grant default document anonymous access in web.config

1 Answers1