I have an ASP.NET MVC3 website with custom authentication (i.e. <authentication mode="None" />). It’s hosted on IIS with only Anonymous Auth enabled to support some SSO work we’re doing. That’s just to say that requesting a plain old file from /Content typically “just works”, e.g. https://oursite.com/Content/ourlogo.jpg opens in the browser window as expected without providing credentials.
Having a problem with CSV files in IE7 and 8, however. I’ve placed the [im]pertinent CSV in /Content/Documents/hello.csv and linked to it normally. When the user clicks the link and chooses “Open”, as opposed to “Save”, it should open smoothly with Excel. However, it appears that Excel is making additional requests for authentication, and the user gets prompted for username/password. Of course, they don’t have those credentials to give, and IIS doesn’t want them anyway. If the user cancels out the prompt, they’ll get it one more time, and after a second cancel, the CSV opens in Excel as desired.
Really want to get rid of those prompts.
The problem in production behaves the same on my dev machine running ASP.NET Dev Server, so it’s probably not a problem with HTTPS or something we configured on IIS. Did a test on an empty MVC site, putting the file in the same relative location. This works correctly. Kind of leaves me thinking there’s a problem in our code, but I’m at a loss to what it might be.
Would love any thoughts, as I’m about out of ideas.
The solution in our case was to deny the HTTP verbs OPTIONS, HEAD and PROPFIND for the directory hosting the CSV in IIS. Apparently Excel is making these calls as part of WebDAV.