Clarification on a Security Issue

[Dimitris Milonas]

Hello to all,

I noticed a problem between two different ways to implement security on a
web page. The situation is the following. I have two pages. The first is the
"Default.aspx" and the second is the "Login.aspx". I also have a
"stylesheet.css" and a "web.config" file.

The first way to implement security (and where the problem occurs) is:
I have inserted the following lines in the web.config file.

<authentication mode="Forms">
<forms name=".ASPXAUTH"
loginUrl="Login.aspx"
protection="All"
path="/"
requireSSL="false"
slidingExpiration="false"
cookieless="UseDeviceProfile" />
</authentication>
<authorization>
<deny users="?" />
</authorization>

Everything is working OK. The problem is that if I try to apply the css file
on the Login.aspx page then nothing happens and the Login.aspx page remains
the same as if I haven't apply a style to it! The problem continues to exist
even if I move the css file to the root directory of the web application,
(which is the same directory with the Login.aspx page) instead of the
App_Themes directory where it was originally created.

Now, the second way to implement security and where the previous problem
does not appear is to put the following lines of code to the Page_Load event
of the Default.aspx page

if (User.Identity.IsAuthenticated == false)
Server.Transfer("Login.aspx");

In this case the Login.aspx page appears with the selected style applied ti
it from the css file!

Any comments on this issue?

Regards
Dimitris Milonas