Question

I am working on an ASP.NET web forms application that is using Forms Authentication. The problem is, it ignores my route and redirects to the login.aspx page.

I have the following route setup:

routes.MapPageRoute("/locale", "{locale}", "~/shorturl/transfer.aspx", 
            false, 
            new RouteValueDictionary { { "locale", "[a-z]{2}" } });

If I use the following url: http://server/minneapolis it goes to the login page. If I add the following to the Web.Config, then it “works” and goes to the transfer.aspx page.

<location path="minneapolis"> 
    <system.web> 
      <authorization> 
        <allow users="*"/> 
      </authorization> 
    </system.web> 
 </location>

I don’t want to have to add all of the locales to the web.config, seems to defeat the purpose.

I can also change the route to (notice I added “/loc/”):

    routes.MapPageRoute("/locale", "/loc/{locale}", "~/shorturl/transfer.aspx", 
            false, 
            new RouteValueDictionary { { "locale", "[a-z]{2}" } });

After that I can change the Web.Config location path to loc (location path=”loc”) and it works, but I’d really prefer to have it at the root. Is there any way to do this?

It’s .NET v4 and I have to support IIS 7 and IIS 7.5

Answer 1

I don’t think there’s a way to do it. Authorization is url based and the authorization module seems to check the source url rather than the destination url when it determines how to authorize the request.

Like 6 months just failed exactly the same way as you did in one of my projects. I ended up with the solution you propose – my routed requests were put in a “subfolder” and I created a local web.config with authorization allow users=*.

If there’s a way around this, I would also like to hear how it should be done.