URL Authorization in ASP.NET 2.0 not working for html and image files

[pop]

Microsoft says that

------------
ASP.NET version 2.0 on Windows Server 2003 protects all files in a
given directory, even those not mapped to ASP.NET, such
as .html, .gif, and .jpg files.
-------------

I have a ASP.NET 2.0 webapp on a 2003 server with the following
Web.Config file

<?xml version="1.0"?>
<configuration>
<appSettings>
</appSettings>
<connectionStrings/>
<system.web>
<compilation debug="true"/>
<authentication mode="Forms"/>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</configuration>

Lets say that the app is on the following URL: www.myapp.com.
When I access www.myapp.com/default.aspx I will correctly be
redirected to the Login.aspx page.
But if I try www.myapp.com/pictures/mypicture.jpg the picture is
loaded without requiring login.
Same happens for html pages.

I have checked that the app is running under NET 2.0 in IIS.
I have tried to install on 3 different 2003 servers but with no
difference.

What am I doing wrong?

Hope you can help

Thanks

 

[Guest]

Microsoft says that

------------
ASP.NET version 2.0 on Windows Server 2003 protects all files in a
given directory, even those not mapped to ASP.NET, such
as .html, .gif, and .jpg files.
-------------

I have a ASP.NET 2.0 webapp on a 2003 server with the following
Web.Config file

<?xml version="1.0"?>
<configuration>
<appSettings>
</appSettings>
<connectionStrings/>
<system.web>
<compilation debug="true"/>
<authentication mode="Forms"/>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</configuration>

Lets say that the app is on the following URL: www.myapp.com.
When I access www.myapp.com/default.aspx I will correctly be
redirected to the Login.aspx page.
But if I try www.myapp.com/pictures/mypicture.jpg the picture is
loaded without requiring login.
Same happens for html pages.

I have checked that the app is running under NET 2.0 in IIS.
I have tried to install on 3 different 2003 servers but with no
difference.

What am I doing wrong?

Hope you can help

Thanks

it's true for Windows Authentication.

What type of Authentication do you use?

 

[Aion]

it's true for Windows Authentication.

What type of Authentication do you use?- Skjul tekst i anførselstegn -

- Vis tekst i anførselstegn -

I use Forms Authentication.
But I read somewhare that it should work for both Windows and Forms
Authentication.
Anyway if it was only working for Windows Authentication there where
nothing new since this could be acompliced in .NET 1.1 by setting
directory security in IIS