Question

I am developing an ASP.NET MVC application that has two kind of pages: (1) a login page, and (2) everything else. Even my home page displays content that requires authorized access:

public class HomeController : Controller {
    [CustomAuthorize] // My custom authorization tag
    public ActionResult Index() {
        // ...
    }
}

But now I have the following “little” problem. When I navigate to http://my-site/, the following sequence of events takes place:

1. Since no controller and no action were specified, the default values (“Home” and “Index”, respectively) are used.

2. Since HomeController.Index() has the CustomAuthorizeAttribute attribute, then I get redirected to my login page.

3. My login page attempts to load, among other things http://my-site/Content/Site.css.

4. In this new request, since there is no controller called ContentController, ASP.NET processes the request as if Content and Site.css were parameters of a request to http://my-site/. Which, of course, requires authentication, and…

Is there any way to make ASP.NET MVC Routing process requests to http://my-site/Content/* or http://my-site/Scripts/* differently than other requests?

---

EDIT: Here is my global.asax file:

public class MvcApplication : HttpApplication {
    public static void RegisterGlobalFilters(GlobalFilterCollection filters) {
        filters.Add(new HandleErrorAttribute());
    }

    public static void RegisterRoutes(RouteCollection routes) {
        routes.IgnoreRoute("{resource}.axd/{*pathInfo}");

        routes.MapRoute(
            "Default", // Route name
            "{controller}/{action}/{id}", // URL with parameters
            new { controller = "Home", action = "Index", id = UrlParameter.Optional } // Parameter defaults
        );
    }

    private void Application_Start() {
        AreaRegistration.RegisterAllAreas();

        RegisterGlobalFilters(GlobalFilters.Filters);
        RegisterRoutes(RouteTable.Routes);
    }
}

Answer 1

Do you have access restrictions in your web.config? If so, you shouldn’t. Typically in an MVC app, you handle that entirely with attributes. I think if actual files exist on disk at the path the request won’t even be routed through MVC. Given your description it seems most likely that your web.config is set up to deny access to unauthenticated users and that should be removed.