ASP.NET Redirect to login page but not for default page

Question

I have an ASP.NET 4.5 / C# site where I am trying to do the following. When users hit the root of the site, www.blah.com, they should be redirected to Default.aspx. This page is open and does not require login. There is a link on this page if they would like to login. However, I need to automatically redirect them to login if they try to access other pages. Some are open to all and some are not. I'm cool with assigning permissions via roles per page or per folder. The issue I have is with Default.aspx.

If a user comes to my site by typing: www.blah.com/Default.aspx then the page comes up with no redirect for a login.

If a user comes to my site by typing: www.blah.com/Admin.aspx then they are redirected to login.

My life is good so far, but...

If a user comes to my site by typing: www.blah.com then they are redirected to login instead of just loading Default.aspx. Here is the relevant web.config.

<location path="Default.aspx">
  <system.web>
    <authorization>        
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<system.web>  
  <authentication mode="Forms">
    <forms name=".ASPXFORMSAUTH" loginUrl="~/Login.aspx" defaultUrl="~/Default.aspx" requireSSL="false" protection="All" slidingExpiration="true" path="/" timeout="240"  cookieless="UseDeviceProfile" enableCrossAppRedirects="false" />     
  </authentication>
  <authorization>
    <deny users= "?"/>
  </authorization>
<system.web>

I assume my specific permission on Default.aspx overrides the generalized deny. Again, this appears to work. The issue I have is the automatic redirect to Default.aspx when someone hits the root of my site, www.blah.com.

As always, thanks!

update

I have moved everything into one of 3 directories: _public, _private, _admin. Let's not worry about _admin for now. Here is how my web.config is set up:

<defaultDocument>
  <files>
    <clear />
    <add value="~/_public/Default.aspx" />
  </files>
</defaultDocument>
.
.
.
<location path="_public">
  <system.web>
    <authorization>        
      <allow users="?"/>
    </authorization>
  </system.web>
</location>
<location path="_private">
  <system.web>
    <authorization>
      <deny users="?"/>
    </authorization>
  </system.web>
</location>
.
.
.
<forms name=".ASPXFORMSAUTH" loginUrl="~/_public/Login.aspx" defaultUrl="~/_private/landingPage.aspx" slidingExpiration="true" path="/" />

I am still doing something wrong. Shouldn't my users come to ~/_public/Default.aspx when they hit www.blah.com? Now it is telling me I don't have a default page specified.

Also, regarding the defaultUrl property of the forms tag. How does this tie in with the DestinationPageUrl of my login control?

Thx!

update I updated the paths in the location tag to "~/folder" instead of "folder". Now instead of an error is just keeps taking me to the login screen. I don't have another authorization tag in the root of web.config, but I am handling the subfolders from the main web.config instead of putting a separate file in each subfolder.

Answer 1

Thank you all for the detailed replies. They were all very helpful and let me to a better overall solution. However, the root of my issue was something very small and annoying. Take a look at my default page again:

<defaultDocument>
  <files>
    <clear />
    <add value="~/_public/Default.aspx" />
  </files>
</defaultDocument>

Notice the path in the value. I experimented with this and found that if I lead with a tilde or a forward slash that this value is completely ignored. Once I specified it as "_public/Default.aspx" everything else fell into place and worked as expected.

I did change a few things up though. I am using three subfolders for pages: _public, _private, and _admin. _public is for anyone, _private is for anyone authenticated, and _admin is for those with special privs. I want to mention that I DO NOT have any Default.aspx file in the root of my website whatsoever. To verify the way I was specifying the path in the web.config was wrong, I have tried switching it back with exactly the same failure.

I'm curious if anyone has spotted this, and do you see it as inconsistent? Most everywhere else in my web.config I can specify a path from root by beginning with a tilde.

So, my site acts as expected...anonymous users hitting public pages works fine. Hitting private or admin pages redirects to login. Once logged in, if you were trying to get to a specific page you go there...if not, you are redirected via the defaulturl in the forms tag. Most importantly, when you type in the name of the site with no page specified, you are taken to the default page...which should have been the simplest part of it all if not for the syntax issue. So there it is....doh!

Answer 2

I would recommend making a landing page that will be the result of the root URL being typed in by the user.

The issue you are seeing is that default.aspx is the default document for a root URL request in IIS and is also the defaultUrl for your Forms Authentication.

Create a Landing.aspx page that has whatever message you want, link to log-in, etc.

Now make this Landing.aspx be the first default document in IIS (make sure it is before default.aspx in the list) so that a root URL request will redirect to Landing.aspx and not get involved with the Forms Authentication at all.

Also, add a <location> entry in web.config to allow all users access to the Landing.aspx page:

<location path="Landing.aspx">
    <system.web>
        <authorization>        
            <allow users="?"/>
        </authorization>
    </system.web>
</location>

Answer 3

If you want to restrict users to folders, you want to create *web.config*s inside each folder (which is a lot easier to maintain than added all in main web.config).

Note: for good design practice (in traditional ASP.Net), you want to place Admin.aspx inside a separate folder. Same for user pages too which required login.

Here is an example -

Main web.config

<system.web>  
  <authentication mode="Forms">
    <forms name=".ASPXFORMSAUTH" loginUrl="~/Login.aspx" defaultUrl="~/Default.aspx" requireSSL="false" protection="All" slidingExpiration="true" path="/" timeout="240"  cookieless="UseDeviceProfile" enableCrossAppRedirects="false" />     
  </authentication>
<system.web>

Users/web.config

Deny anonymous access. In other words, user is required to login before accessing any pages inside User folder.

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <deny users="?"/>
    </authorization>
  </system.web>
</configuration>

Admin/web.config

Deny everyone except users in Administrator role.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.web>
    <authorization>
      <allow roles="Administrator" />
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

Answer 4

try the following:

1. Create a folder for example admin and put the Login.aspx there

2. Set authentication to forms

   <authentication mode="Forms">
   <forms name="HIVLogin" loginUrl="~/admin/Login.aspx" timeout="20" protection="All"/>
   </authentication>
   

3. then under system.web

   <location path="Admin">
   <system.web>
     <authorization>
       <allow roles="Admin" />
       <allow users="Admin" />
      <deny users="*" />
     </authorization>
   </system.web>
   

Answer 5

There is no need to write any code to set a page as your default page in ASP.NET. Got to Solution Explorer and right click on the page you like to set as default and click on Set As Start Page.

Answer 6

You need to add following mappings under section<system.web>.

<urlMappings enabled="true">
    <add url="~/" mappedUrl="~/Default.aspx" />
</urlMappings>

This will redirect to default.aspx when you browse root url i.e www.domain.com or localhost.

Thanks.

Answer 7

I spent about 6 hours debugging the issue. Our website was working fine, and suddenly it started redirecting to login page instead of default page (unauthenticated). Our web.config included all authentication/authorization settings correctly.

    <authentication mode="Forms">
      <forms name="MyAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30" />
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>

  <system.webServer>
    <defaultDocument>
      <files>
        <clear />
        <add value="default.htm" />
      </files>
    </defaultDocument>
...
  </system.webServer>

  <location path="default.htm">
    <system.web>
      <authorization>
        <allow users="?" />
      </authorization>
    </system.web>
  </location>
...

SOLUTION: You need to remove Extensionless URL feature from your website. Ref: https://support.microsoft.com/en-us/help/2526854/users-may-be-redirected-to-the-login-page-of-an-asp-net-4-application

<system.webServer>

     <handlers>
          <remove name="ExtensionlessUrlHandler-ISAPI-4.0_32bit" />
          <remove name="ExtensionlessUrlHandler-ISAPI-4.0_64bit" />
          <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
     </handlers>

     <validation validateIntegratedModeConfiguration="false" />

</system.webServer>

After the fix, the website was back to normal.