Anonymous authentication using generic asp.net handler (*.ashx)

Question

I have an asp.net webforms application that has windows authentication enabled. I need to enable anonymous authentication on a folder “Test” in the website which contains images . I did that by adding

<location path="Test">
<system.webServer>           
  <security>
    <authentication>          
      <anonymousAuthentication enabled="true"/>
    </authentication>        
  </security>
</system.webServer>

Now any requests to images in Test folder is unauthenticated and everything works as expected until I introduced a generic handler for this folder which fetches files from the backend storage if the file is not found in the “Test” folder and boom it broke! Anonymous authentication doesn’t work anymore. Updated web.config file below -

<location path="Test">
<system.webServer>      
  <handlers>       
    <add verb="*" path="Test"  requireAccess="None" name="Handler1" type="WebApplication1.Test.Handler1, Anonymous" />
  </handlers>
  <security>
    <authentication>          
      <anonymousAuthentication enabled="true"/>
    </authentication>        
  </security>
</system.webServer>

I inspected the request using fiddler and it returns HTTP/1.1 401 Unauthorized message if I have the handler section in config but if I remove the handler section from config everything just works fine and I can see the valid response in fiddler. Any insight into what could be wrong here?

score 0 · Answer 1 · answered Nov 08 '17 at 14:40

Finally I was able to resolve it myself by modifying the location configuration as shown below by adding system.web to allow all users

<location path="Test">
<system.webServer>      
  <handlers>       
    <add verb="*" path="Test"  requireAccess="None" name="Handler1" type="WebApplication1.Test.Handler1, Anonymous" />
  </handlers>
  <security>
    <authentication>          
      <anonymousAuthentication enabled="true"/>
    </authentication>       
  </security>
</system.webServer>
<system.web>
  <authorization>
    <allow users="*"/>
  </authorization>
</system.web>

Anonymous authentication using generic asp.net handler (*.ashx)

1 Answers1