IIS 6 and ASP.NET security

Discussion in 'ASP .Net Security' started by Michael Tsai, Aug 18, 2005.

  1. Michael Tsai

    Michael Tsai Guest

    Hi,
    It said that IIS 6 use HTTP.sys as the front end for
    handling HTTP request, and pass ASP.NET requests
    to w3wp.exe. So I think this also means security
    settings in IIS (metabase) is bypassed, right?

    Apparently the answer is no, I'ved tried using IIS to set my
    ASP.NET web application's authentication method to basic
    authentication, but my web app's web config still allow
    anonymous access. When I use browser to acces my Web
    app, it asks me to input username and password. So IIS
    metabase is still used, but how? All the information I found
    with Google just show that HTTP.sys directly pass request
    to w3wp.exe, so when/where did IIS metabase be read and
    applied?

    Thanks!

    Michael Tsai
    Michael Tsai, Aug 18, 2005
    #1
    1. Advertising

  2. Hello Michael,

    W3svc reads the metabase on statup (or when changed) and registers all the
    information with http.sys.

    ---------------------------------------
    Dominick Baier - DevelopMentor
    http://www.leastprivilege.com

    > Hi,
    > It said that IIS 6 use HTTP.sys as the front end for
    > handling HTTP request, and pass ASP.NET requests
    > to w3wp.exe. So I think this also means security
    > settings in IIS (metabase) is bypassed, right?
    > Apparently the answer is no, I'ved tried using IIS to set my
    > ASP.NET web application's authentication method to basic
    > authentication, but my web app's web config still allow
    > anonymous access. When I use browser to acces my Web
    > app, it asks me to input username and password. So IIS
    > metabase is still used, but how? All the information I found
    > with Google just show that HTTP.sys directly pass request
    > to w3wp.exe, so when/where did IIS metabase be read and
    > applied?
    > Thanks!
    >
    > Michael Tsai
    >
    Dominick Baier [DevelopMentor], Aug 19, 2005
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. TC
    Replies:
    9
    Views:
    445
  2. Jon Davis
    Replies:
    3
    Views:
    563
    Jon Davis
    Jun 21, 2007
  3. Competitive Dad

    ASP.NET and IIS Security

    Competitive Dad, Jan 28, 2008, in forum: ASP .Net
    Replies:
    6
    Views:
    411
    Competitive Dad
    Jan 30, 2008
  4. TC
    Replies:
    9
    Views:
    153
  5. Michael Tsai

    IIS 6 and ASP.NET security

    Michael Tsai, Aug 18, 2005, in forum: ASP .Net Security
    Replies:
    0
    Views:
    90
    Michael Tsai
    Aug 18, 2005
Loading...

Share This Page