Unauthenticated users can't see images in website

Question

When I run my website through debug mode in visual studio everything looks great and all the images on the page show up fine. But once I deploy my website to an IIS7 web server (doubt that other versions would make any difference, but you never know) then users can't see the images on the site until they log in.

The website is an asp.net MVC site and I'm new to MVC, though I do have lots of experience with asp.net forms. It seems that only authenticated users are allowed to access the images folder, and there is an authorization section in my web.config saying that only admins can access the site, so how do I make it so that all users, authenticated or otherwise can view the images?

-- Update --

I tried putting in the configuration block suggested, which from everything I can tell makes perfect sense, but it didn't seem to make a difference. The sample below has Content/Images for the path but before that I tried just Content, since it's OK for everything in there to be accessible. I also tried setting the allowOverride setting to false, which also didn't seem to make a difference.

<location path="Content/Images">
    <system.web>
        <authorization>
            <allow users ="*" />
        </authorization>
    </system.web>
</location>

--Update 2-- Funny thing is that I don't even see any explicit deny entries in my web.config, just an allow for admin's, and when I went into IIS 7 and used the UI to allow all users access to the Content directory it didn't show any deny's on the list either. But then again, this project works fine when I just debug it from my personal computer, it's only after I deploy it that I have problems...

<authorization>
    <allow roles="admin" />
</authorization>
<authentication mode="Forms">
    <forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>

Can you post the section in the web.config where you specify that only authenticated users can access the site? — Omar, Nov 07 '10 at 15:48
How did you resolve this issue? Actually, I want the opposite, but it doesn't matter :) — Mikhail, Sep 27 '12 at 09:54
@Mikhail - I wish I could tell you... I knew at one point and should have posted it when I figured it out, but anymore I don't remember. I didn't upvote any of the answers... Sorry! — Peter, Sep 27 '12 at 13:42
@Peter Ok, thanks, I already found solution for my case: http://www.4guysfromrolla.com/articles/122408-1.aspx — Mikhail, Sep 27 '12 at 13:49

Omar · Answer 1 · 2010-11-07T16:17:11.873

14

In your web.config file, after the </system.web> tag, add the following

<location path="images">
     <system.web>
       <authorization>
        <allow users ="*" />
       </authorization>
    </system.web>
</location>

where path="images" is the name of the folder with your images/css.

Update:

If you're using ASP.NET MVC, I would remove the authorization declaration in the web.config file and use the [Authorize] attribute on the controllers that need to be locked down.

You can also specify the roles you want to grant access to using [Authorize("admin")].

edited Nov 07 '10 at 16:17

answered Nov 07 '10 at 06:41

Omar

39,496
45
145
213

I tried your suggestion, which makes perfect sense, but didn't have any luck. Please see my update in my edited posting. – Peter Nov 07 '10 at 15:40
#2 - So I tried your suggestion to use an Authorize attribute, and it does work as far as only allowing authorized users to access those pages; I also removed the authorization entry from web.config... but nothing has changed and users STILL can't access images without logging in. It's confusing, I can't figure out what's blocking it. – Peter Nov 10 '10 at 02:45
@Patricker, are you using a `BaseController` that all controllers inherit from and is there an `[Authorize]` attribute on it? – Omar Mar 06 '11 at 00:53
Wow! Thanks a lot. I had this issue in local debugging only for years! It was OK on publish server though. Now it's ok in both situations. – Matt Roy May 16 '16 at 19:02

score 6 · Answer 2 · answered Aug 01 '13 at 16:29

6

Just ran into the same problem. We noticed it on our Login page. The CSS and images weren't loading (they were under the content directory). Adding IUSR to the folder with Read privileges fixed it for us.

answered Aug 01 '13 at 16:29

Josh

10,352
12
58
109

score 6 · Answer 3 · answered Mar 03 '12 at 20:08

By default, the configuration you define in a Web.config file, applies to every subdirectory of its containing folder. If you have a Web.config in the application root, that configuration will propagate to every subdirectory, including those where you have images and Css style sheets. So, if you have in your root Web.config a rule like this one:

<system.web>
...
<authorization>
  <deny users="?"/>
</authorization>
...
</system.web>

anonymous users will not be able to access the resources needed to display the page like you would expect it.

To fix it, you need to include another Web.config in every subdirectory that has presentation resources, and apply the rules you want to override. In your case, this should do the work:

<?xml version="1.0"?>
<configuration>
   <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
   </system.web>
</configuration>

If you are using Themes, place a single Web.config file in the theme folder.

score 2 · Answer 4 · edited Dec 10 '12 at 18:54

Old question but I came across the same problem and found the answer. I had created a new folder for the Membership pages that I wanted logged-in users to have access to, but the images wouldn't show up in them! It turns out that no matter what I tried I couldn't set a relative path to the images from within the Members folder.

The problem was the html image (as far as I could tell anyway, correct me if I'm wrong). I swapped it out for an asp:image with a relative path and now it works great. My new code: asp:image runat="server" id="Logo" ImageUrl="~/Images/logo.jpg"

Notice the ' ~/ ', that wouldn't work for me with I tried: img src="../Images/logo.jpg", img src="~/Images/logo.jpg", img src="/Images/logo.jpg", etc. to no avail.

Hope this answer helps someone solve this problem more quickly in the future.

score 1 · Answer 5 · answered Nov 07 '10 at 05:17

1

Try browsing the image file directly and see if that comes up for an anonymous user. In IIS 7, there is a way in which you can authorize anonymous users directly from your UI [which in turn would create the web.config if it doesn't exist].

Folder -> .NET Authorization Rules -> Add Allow Rule

answered Nov 07 '10 at 05:17

Rahul Soni

4,941
3
35
58

I tried doing this by hand a while ago without success, but just to make sure it wasn't just me doing something wrong I did try using the UI to make it, and it did make a web.config file in the sub directory, but the results were the same and I still get prompted to login before I can access anything in my Content directory. – Peter Nov 07 '10 at 15:47
What is the code in IIS Logs? Try getting Failed Request Tracing logs and check if you get any lead. Also, let me know what happens if you create a simple htm file and try to browse it directly from the UI using right click browse? Does the htm work if you try it directly? – Rahul Soni Nov 07 '10 at 17:04
One more thing... if all the previous steps fail, try creating a new test file called security.aspx, and follow this post for code. Share the output with me [or analyze it yourself] to find which user is currently active for accessing your content. http://www.dotnetscraps.com/dotnetscraps/post/Sample-ASPX-page-to-show-security-details-in-ASPNET.aspx – Rahul Soni Nov 07 '10 at 17:17

score 0 · Answer 6 · answered Aug 01 '13 at 08:05

We came across the same problem in our project and found a solution, although we are not sure about the reasons of this behaviours.

We had a similar scenario, with a folder containing all our png images. Our marketing colleague wanted to rename some of them, so to make it easier for her, we shared (this might be the key) that folder, granting read/writer rights to her.

From this point, the images started behaving as you describe, requiring authorization for being accessed. No unauthorized user could see them any more.

We realized that the problem was related to sharing the folder because it started happening at that point of time. Otherwise we still don't see any relationship among ASP.NET MVP user authorization/login and hard disk user rights. We could have expected an IO Exception or something similar, but not this behaviour.

After checking the folder, and comparing with other folders, we realized that after sharing, the permissions on the folder had slightly changed. Mainly they did not inherit from its parent folder anymore and some permissions such as CREATOR OWNER and MACHINE_NAME\Users had dissapeared (although IUSR and the app pool user were still there).

So, we renamed that folder, created a new one with the same name, and copied the content from the old folder to the new one. The new folder had the permissions inherited from its parent and everything started to work perfectly again.

It solved our problem, but we are still not sure why this all happened this way.

Regards

score 0 · Answer 7 · answered Nov 07 '10 at 06:39

Are you using membership framework. I suspect that you have misconfigured your permission settings in web.config and your images folder is only allowing authorised requests. This can be easily change via web.config. Just remove the folder name from your authorised section and this should solve the problem.

For your reference this should be the section in web.config if you are using membership framework :

 <authorization>
  <deny roles="xyz" />
</authorization>

Unauthenticated users can't see images in website

7 Answers7

Update:

Linked