Can't make forms authentication for non-ASPX files work

[Ronald S. Cook]

In my web app, I want to secure not only .aspx files, but also .htm files.
From what I've read, I have to jump through some hoops to protect the .htm
files.

In IIS, I right clicked on the default web site and clicked on the ISAPI
Filters tab. I added ".htm" and chose
"C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll" as the
executable.

I then added the following in the Web.config within the system.web tags:

<httpHandlers>
<add path="*.htm" verb="*" type="System.Web.StaticFileHandler"
validate="true" />
</httpHandlers>

But it didn't work. I have no idea if what I did was right, but obviously
it wasn't. Can someone please help.

Thanks,
Ron

 

[Edwin Knoppert]

Odd, a protected website's images folder of mine doesn't show an image
unless i put a webconfig allow * in the images dir.

So?