ASP.net deny access to folder doesn't work on IIS

Question

I want to deny access to the folder with images on my site.

I use the following section in web.config for this:

<location path="images/catalog">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>

It works fine locally but doesn't work on the server (IIS7). Any ideas?

May be you have another solution how to deny access to images in specific folder.

Possible duplicate of [IIS7 Forms Authentication Doesn't Deny Image Access](http://stackoverflow.com/questions/6447273/iis7-forms-authentication-doesnt-deny-image-access) — giammin, Nov 13 '15 at 14:16

score 0 · Accepted Answer · edited May 23 '17 at 10:27

I have found solution.

I have added this section to web.config:

<system.webServer>
  <modules runAllManagedModulesForAllRequests="false">
    <remove name="FormsAuthenticationModule" />
    <add name="FormsAuthenticationModule" type="System.Web.Security.FormsAuthenticationModule" />

    <remove name="UrlAuthorization" />
    <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
  </modules>
</system.webServer>

The reason - IIS7 for some reason ignores forms authentication.

In these questions you can find the cause and solution:

ASP.net deny access to folder doesn't work on IIS

1 Answers1