Question

I’m starting a simple web application, using ASP.Net MVC 3.

I made a few pages, mostly for the authentication, which uses custom provider & asp form authentication.

On my Visual studio local server, it works great, when I go on a page with an [Authorize] attribute, I’m redirected to my login page, and after I’m logged, I can visit this page without any problem.

I published through FTP my website on a dedicated server(on my LAN), and now, when I go to the website, I’m correclty redirected to the login page, but instead of getting the login page, I get the 401 Unauthorized exception.

Edit: Clarification, my login page is /Account/Auth/Login, if I try to access anything (e.g. /OtherArea/OtherController/OtherAction, I get redirected to /Account/Auth/Login, but it displays me an error 401)

This is the same problem either if I try it locally on the server or from my desktop.

I’ve the same web.config file, no other authentication mode enabled, the user of my application pool has full control on the directory. What can be going wrong?

I enabled detailed error, and the only details I get is this:

You are not authorized to view this page due to invalid authentication
headers.

Is there some pre-requisite to install in addition of asp.net 4+publish? Does the publish copy all the needed dll of asp.net?

Answer 1

Check web.config settings for system.web/authorization; you should either not have that element at all, or it should only contain <allow users="*"/>.MVC is using its own logic (AuthorizeAttribute) to determine what an anon user may access (or not). Web.config settings should not collide with this.

Check if anonymous authentication is enabled within IIS for that website. Besides that one, Forms Authentication needs to also be enabled, and all other auth modes (if they are installed) should be disabled.