IIS Basic Authentication only protects directories, not individual files?

Question

I really hope this isn't a duplicate, but I wasn't able to find anything like this on here.

My issue is: I have a subdirectory on a Windows (not sure if 2008 R2 or 2012) server with IIS 8.5 that I want to protect with basic authentication. I've talked to the server admin and he activated basic auth for me and added a Windows user for me. The protection works, but only for directories, not individual files.

This leads to bizarre situations like "sub.domain.com/subsubdir/" is only accessible with the correct user/password combination, but "sub.domain.com/subsubdir/index.php" is open for all to visit, and I can't figure out why. The way I've implemented this in the web.config is this:

<location path="dir/subdir">  
    <system.web>
        <authorization>
            <allow users="authorizedUser"/>
            <deny users ="?" />    
        </authorization>
    </system.web>
</location>

Where the subdomain points to "dir/subdir", thus "sub.domain.com/subsubdir/" to reach the subdirectory.

I tried dir/subdir/ and dir/subdir/*, but both lead to errors. Either I'm using the wrong keywords, or Google doesn't know about my problem.

I'm not even sure if that's something I have to fix on my side (only access via FTP) or if it's some Windows setting that the admin has to change. Does anyone know what's happening here?

Edit: I got confused with my own subdirectories and forgot a level. Not sure if that's relevant, but I edited it anyway.

So if you have closed all your browser sessions, and surf directory to /subdir/file.php, it displays it without prompt? — MichelZ, May 21 '14 at 14:27
Exactly. I even used several different browsers to be sure there's no cache involved. — Christian, May 21 '14 at 14:33
Yes, that's usually how you do that if you require auth for the whole application / directory — MichelZ, May 21 '14 at 14:37
Okay, I'll talk to him and see if that works as intended. But would then surfing to /subdir/file.php result cause the prompt to appear? — Christian, May 21 '14 at 14:44

score 4 · Accepted Answer · answered May 21 '14 at 14:44

4

You should disable anonymous authentication for the directory if there is no need to have anonymous users. This will take care of the problem

answered May 21 '14 at 14:44

MichelZ

11,068
4
32
59

Thanks for the help. I'll try that and come back here as soon as I have results. – Christian May 21 '14 at 14:57
Seems like I won't be able to test this anytime soon because of unrelated things, but I trust your answer enough to accept it anyway. Thanks for the help! – Christian Jun 10 '14 at 09:00

IIS Basic Authentication only protects directories, not individual files?

1 Answers1