4

I'm starting a simple web application, using ASP.Net MVC 3.

I made a few pages, mostly for the authentication, which uses custom provider & asp form authentication.

On my Visual studio local server, it works great, when I go on a page with an [Authorize] attribute, I'm redirected to my login page, and after I'm logged, I can visit this page without any problem.

I published through FTP my website on a dedicated server(on my LAN), and now, when I go to the website, I'm correclty redirected to the login page, but instead of getting the login page, I get the 401 Unauthorized exception.

Edit: Clarification, my login page is /Account/Auth/Login, if I try to access anything (e.g. /OtherArea/OtherController/OtherAction, I get redirected to /Account/Auth/Login, but it displays me an error 401)

This is the same problem either if I try it locally on the server or from my desktop.

I've the same web.config file, no other authentication mode enabled, the user of my application pool has full control on the directory. What can be going wrong?

I enabled detailed error, and the only details I get is this:

You are not authorized to view this page due to invalid authentication headers.

Is there some pre-requisite to install in addition of asp.net 4+publish? Does the publish copy all the needed dll of asp.net?

1
  • can you please clarify > I'm correclty redirected to the login page, but instead of getting the login page, I get the 401 Unauthorized exception. It either goes to the login page or it doesnt?
    – wal
    Jan 26, 2012 at 14:51

1 Answer 1

5

Check web.config settings for system.web/authorization; you should either not have that element at all, or it should only contain <allow users="*"/>.MVC is using its own logic (AuthorizeAttribute) to determine what an anon user may access (or not). Web.config settings should not collide with this.

Check if anonymous authentication is enabled within IIS for that website. Besides that one, Forms Authentication needs to also be enabled, and all other auth modes (if they are installed) should be disabled.

1
  • 1
    The anonymous mode isn't enabled, if I activate it, I risk to have some unauthorized access, no?
    – J4N
    Jan 26, 2012 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.