Unauthorized users cannot access static files in ASP.NET MVC regardless of location elements

Question

I know this question has been asked several times on SO, but none of these answers worked in my situation. I have an ASP.NET MVC2 application that uses forms authentication on my local IIS 7.5 (7600.16385) in AppPool running in integrated mode. Interestingly, this does not work when using the development web server that ships with VS 2010. My web.config file does not contain <authorization /> and no <location /> elements. When I get to the main page, I get everything in login mode, except for the .CSS and .PNG files stored in the ~/Content directory. When I directly request a .CSS file from http: //localhost/WebSubscribers/Content/Site.css , I am redirected to the login page. It seems that wild-card matching is trying to resolve every request, even if I resolve this request with <location path="Content" /> , as shown below:

 <location path="Content" > <system.web> <authorization> <allow users="*"/> </authorization> </system.web> </location> 

Most of the answers I found on Stack Overflow suggest adding such a location element to fix the problem, but this does not work for me, so I deleted it.

I did not create wild-card mappings in IIS, and to make sure I deleted the site and recreated it by pointing to the same directory, only to get the same results. Is it possible to display a wild card map anywhere except IIS? Can my web.config file get some kind of cartographic mapping? I am using Telerik MVC controls that seem to have made some changes (registered namespaces, httpHandlers, modules) to the web.config file.

Any other suggestions?

UPDATE:. When using Chrome to access a website without authentication, the Resources developer tool reports the following about the Site.css file: "Site.css: -1Resource is interpreted as a stylesheet, but passed in with text of the MIME / html type."

Where will this type of mime be installed? The node site in IIS says: ".css | text / css | Inherited".

Answer 1

I found the cause and solution of my problem in IIS. The web application runs in IIS from my Visual Studio Projects directory, so I configured it to use AppPool, which runs under my user account. In IIS, the Anonymous Authentication feature has been configured as Specific User: IUSR . I do not know why and how. When I changed this to an application pool identifier, unauthenticated users could access static files.

+1 to Craig Stuntz , indicating that wild-card mappings as well as location elements are not needed for MVC and IIS 7.

Answer 2

You should not use wildcard mapping for IIS 7 in integrated mode. You only need this for IIS 6 / "classic" mode. You do not need a location element; it is "just working."