Security :: UrlAuthorization Module Does Not Work Expect On IIS7?
Sep 21, 2010
Here are the structure of my web site:Login.aspx in the root pathUserInfor.aspx and 1.txt in the sub-directory folder named 'Restricted' Authenticate this website with form authentication configured in IIS, and does not allow anonymous to get into the Restricted folder with the web.config file.I think it should work this way, if I manually access the 1.txt in the browser, I should be able to view the content, and if I go to the modules configuration for this applicaiton in IIS7, find the 'UrlAuthorization' module, and cancle the listbox for 'invoke for requests to asp.net ...', I should be directed to the loginurl setting in the root web.config file when I access the 1.txt file without logging, however, I still can see the content of 1.txt.
View 1 Replies
Similar Messages:
Jan 8, 2010
[FYI - Posted the same thing over at StackOverflow]I've used the UrlRewriting.Net module for a couple years now without any problems in Windows XP and Windows 2003. I just recently upgraded my home PC to Windows 7 and started developing a new website.The plan was to use .html extensions and rewrite them to their .aspx counterparts using the UrlRewriting.Net module. Everythingworks flawlessly in VWD 2008, but when I try running it through IIS7 it is a different story.
When I try to access a page via the .html rewrite I can no longer access Page.User; it keeps returning null. If I hit the page using it's .aspx extension, Page.User is correctly populated. I should also mention that I have a LoginView controller in my Master Page and it suffers from the same symptoms: When accessing via .html extension it shows the AnonyousTemplate; When using .aspx extension it properly shows the LoggedInTemplate. I'm guessing the two are related.[Note: I've also tried extensionless URLs and they exhibit the same problem]The only way I've gotten it to work is to switch the application pool to Classic, which then requires me to add an ASP.Net ddl handler for the .html extension [otherwise it is handled by the StaticFileHandler and comes up as a 404 error]. However, I'd like my web app to run properly for people without having to fiddle around with IIS.
So I am left with several questions:Does anyone have ideas as to why Page.User always equals null for .html => .aspx rewritten pages?Why does it work in VWD 2008, but not IIS7? What changed from IIS6 => IIS7 that could have caused this? Any other thoughts on workarounds?[Note: I just tried a .aspx => .aspx rewrite and it did not exhibit the problem. Not really what I want, but thought I should mention it.]
View 5 Replies
Nov 9, 2010
I'm using .net 4.0 and iis 7 and windows server 2008
my web application use form athentication and wok properly in vs 2010
but when i try to config the web site in iis 7 the form athenticate redirection doesn't work without any kinds of error.
here is my web.config code
<authentication mode="Forms">
<forms loginUrl="Pages/login.aspx" name=".ASPXFORMSAUTH"></forms>
</authentication>
<authorization>
<allow users="?" />
</authorization>
I enabled the authentication form in iis.
View 3 Replies
Feb 19, 2010
Is it possible to use iis7 url rewrite module for html pages?
Like this:
http://www.site.com/index.html?x=newfolder =>
http://www.site.com/newfolder
View 2 Replies
May 6, 2010
I have web services built with ASP.NET and ASP.NET clients consuming them. When consuming the webservices, how would I to force the clients to use https?
I don't want to force the whole site to use https by turning on require SSL in IIS.
Can I use the IIS7 URL rewrite module to re-route http requests to https?
View 2 Replies
Jan 8, 2010
I've used the UrlRewriting.Net module for a couple years now without any problems in Windows XP and Windows 2003. I just recently upgraded my home PC to Windows 7 and started developing a new website.The plan was to use .html extensions and rewrite them to their .aspx counterparts using the UrlRewriting.Net module. Everything works flawlessly in VWD 2008, but when I try running it through IIS7 it is a different story.
When I try to access a page via the .html rewrite I can no longer access Page.User; it keeps returning null. If I hit the page using it's .aspx extension, Page.User is correctly populated. I should also mention that I have a LoginView controller in my Master Page and it suffers from the same symptoms: When accessing via .html extension it shows the AnonyousTemplate; When using .aspx extension it properly shows the LoggedInTemplate. I'm guessing the two are related.
[Note: I've also tried extensionless URLs and they exhibit the same problem]
The only way I've gotten it to work is to switch the application pool to Classic, which then requires me to add an ASP.Net ddl handler for the .html extension [otherwise it is handled by the StaticFileHandler and comes up as a 404 error]. However, I'd like my web app to run properly for people without having to fiddle around with IIS.So I am left with several questions:Does anyone have ideas as to why Page.User always equals null for .html => .aspx rewritten pages?
Why does it work in VWD 2008, but not IIS7?
What changed from IIS6 => IIS7 that could have caused this?
[Note: I just tried a .aspx => .aspx rewrite and it did not exhibit the problem. Not really what I want, but thought I should mention it.]
View 2 Replies
Jan 18, 2010
I have the following setting in my web.config to redirect to a default page:
<defaultDocument>
<files>
<clear/>
<add value="default.aspx"/>
</files>
</defaultDocument>
For example when a user enters www.homeforhire.com they should be redirected to default.aspx (for operational reasons the user is then redirected to
www.homeforhire.com/home.aspx).
Instead an error is caught in the Rewrite module (which should not be activated). I am using an http module to perform URL rewriting.
It appears as if the default document setup is not working correctly, and the requested page ~/ is being sent to the Rewrite module, causing an error (which is then caught by my error handler and the user is redirected to the home page).
Entering www.homeforhire.com/default.aspx works correctly.
Can anyone tell me why the default document settings in the web.config do not appear to be working?
View 1 Replies
Feb 16, 2011
I need to force every request to https://www.mysite.com (always with https and www)
The site is hosted in GoDaddy and I need to do it via IIS7 URL Rewrite Module.
I've been able to do the HTTPS redirect with the following code:
<system.webServer>
<rewrite>
<rules>
<rule name="Canonical Host Name" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTP_HOST}" pattern="^mysite.com$" />
</conditions>
<action type="Redirect" url="https://www.mysite.com/{R:1}" redirectType="Permanent" />
</rule>
</rules>
</rewrite>
</system.webServer>
Test cases
http://mysite.com -> https://www.mysite.com OK
http://www.mysite.com -> https://www.mysite.com NOT WORKING
I guess the condition is not being satisfied when I enter www.mysite.com in the browser, so there's no redirect and the page serves as HTTP instead of HTTPS.
I think I just need to modify the condition pattern, but I have almost nothing regex knowledge and I need this asap.
View 1 Replies
Mar 30, 2011
I am using IIS7's URLRewrite feature to hide the .aspx extension in my ASP.NET WebForms application's URLs.
I'm using the following configuration:
[code]....
I can now browse to:
[URL]
and this is rewritten to:
[URL]
This preserves the "pretty" url in the browser address bar. I have also updated all my links on the site to use the extensionless URLs.
The problem is that the underlying .aspx pages can still be accessed directly and I'd like to prevent this.
If a user browses to [URL] I'd like it to either redirect/rewrite to [URL], or at the very least just return a "Page not found".
Update:
I managed to get this working by redirecting all .aspx pages to the home directory. This isn't ideal as I'd prefer to send them to the non-.aspx version, but it will do for now.
<rule name="Block .aspx" stopProcessing="true">
<match url=".aspx" />
<action type="Redirect" url="/" />
</rule>`
How do I rewrite and redirect URLs that directly address .aspx pages to my friendly URL format?
View 2 Replies
Sep 21, 2010
I'm probably going to use the URL rewrite module for IIS 7 eventually and I have a fairly straight forward question that I really can't find the answer to.
If you have a base case of:
http://yoururl.com/page.aspx?ID=7
You can obviously have it rewritten to:
http://yoururl.com/page/7 or whatever you want.
My question is this: When using this module can you still use Request.Querystring["page"] on the rewritten querystring. How does the Request.URL stuff work. Does asp.net still provide the un-rewritten url or does it provide the rewritten one.
I would assume that your C#/asp.net code is completely unaffected by the url rewriting, as that's more or less the point, but I want to be crystal clear.
Secondary question: What is the best practice for how you should code a website when using the rewritten. Should you code links in the written style, or continue using querystrings?
View 1 Replies
Jul 21, 2010
Okay I've read the other StackOverflow postings, forum posts on MSDN, everywhere. I CANNOT get this to work for the life of me.
Here is what I have setup.
In IIS7.0
- Default Site in ASP.NET v4.0 App Pool
- C:Inetpubwwwroot as the physical path
I published my MVC2 site in VS2010 to the Default Site path, it succeeded.
Here are the settings for that:
- Same App Pool
- C:InetpubwwwrootPerfectSchedule as the physical path
- Default Document is Views/Home.mvc
I open the URL in my IE browser
- http://localhost/ --> just gives me the Apache "It works!" page
- http://localhost/PerfectSchedule --> The WebPage cannot be found
- http://perfectschedule/ --> Internet Explorer cannot display the webpage
View 2 Replies
Feb 27, 2011
I get a website working perfectly in VS2008 but when I publish it on IIS7 ajax doesn't work at all.I guess it is a problem in my web.config but I don't know what. Here is the web.config file :
[Code]....
View 4 Replies
Apr 2, 2010
The application is hosted in Windows Server 2008 with IIS7.
I have a button that calls a new webpage (asp.net page, ext .aspx) that contains
Response.OutputStream.Write(blahblahblah) which then should prompt a download box to allow user to save an image.
Now the page basically creates a stream and then is supposed to output the stream to the user using Response.Outputstream.Write.
Then the user is supposed to be prompted to open or save the document. This works fine in Firefox but it does not work with IE7 or 8
Also this exact same code works with IIS6 on a Windows 2003 server.
So the only differences is the IIS6 and Windows 2003 Server to IIS7 and Windows 2008 Server.
And what happens is when I clicked the button, the page did pop up but disappear 1-2 seconds later without
prompting the download box to the user.
Here is the code that launches for Reference
//e.g file = 123424_43535.jpeg
FileInfo myFile = new FileInfo(Server.MapPath("mapImage/") + file;
using(var fs = myFile.Open(FileMode.Open, FileAccess.Read))
{
byte[] buffer;
int read;
buffer = new byte[(int)fs.Length];
Response.AddHeader("Content-Disposition", "attachment;filename=" + file);
Response.ContentType = "application/x-force-download";
Response.AddHeader("Connection", "Keep-Alive");
Response.AddHeader("Content-Length", fs.Length.ToString());
while((read = fs.Read(buffer, 0, buffer.Length)) > 0)
{
this.Response.OutputStream.Write(buffer, 0, read);
}
}
Response.End();
I have tried to replace Response.AddHeader with Response.AppendHeader, however the result is still the same. Also, I have tried to replace the Response.ContentType with application/octet-stream and image/jpeg, I also faced the same result.
Is there any setting/modification on server/code that I need to look on?
View 13 Replies
Nov 19, 2010
In my local enviroment it just works. Iam no IIS Admin so ....
i try the following
My domain "http://mysite.com/" goes to my url provided by my hosting service (discountasp.net)
I want that this url goes to the root/mysite/ virtual directory but i want that the url stays on "http://mysite.com/". So i defined the following rule, but it doesnt work for me.
here is my web.config that is placed in the root directory (generated by the IIS7 Remote Administration UI)
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>[code]....
View 1 Replies
Apr 18, 2010
I did drop down list that fill its value from databaseBut when it run it dose not get first row and get others and if I add new it get it what is the problem?
private void LoadWithCategory()
{
if (Request.QueryString["Category_Id"] != null)
[code]...
View 2 Replies
May 25, 2010
I been trying to get my Visual Studio 2008 to run my Web Application on IIS7 on my Windows 7 machine but I just can't get it to work. I'm using the SQLEXPRESS I been following this Tutorial, but I get the following error message.
"Failed to generate a user instance of SQL Server due to failure in retrieving the user's local application data path. make sure the user has a local user profile on the computer. The connection will be closed."
my connectionString seem to be ok
[Code]....
The site run with out database connection.
View 3 Replies
May 11, 2010
We had some content restructure recently and I'd like to put in some redirect rules into web.config so bookmarks to the old pages can get routed to their new locations/pages.I tried using this approach:
<location path="~/product/productA.aspx">
<system.webServer>
<httpRedirect enabled="true" destination="~/product/category/productA.aspx" exactDestination="false" childOnly="true" httpResponseStatus="Permanent" />
</system.webServer>
</location>
But all I'm getting when I go to "[URL] is our http 404 page.Am I doing something wrong, or is the httpRedirect tag in web.config not supported in mono?
View 1 Replies
Mar 21, 2011
I'm simply adding to a set of rules on existing rewrite rules for our company website. We have a file that we need to restrict to only our internal IP addresses. The URL is http://oursite.com/internal/index.aspx?u=blahblah and need it restricted to IP ranges 10.1.X.X. I'm adding this and it's not doing anything. Even if I tried to capture all using .* for the pattern, it still ignores it. Is my syntax correct?
<rewrite>
<rules>
...
<rule name="Restrict URL" enabled="true" stopProcessing="true">
[code]...
View 1 Replies
Jan 8, 2010
I'm looking for a tutorial or starter kit whereas I can build an admin page for my website that was built with VWD 08. I'm using the ASPNETdb for membership. My main focus is an admin page where I can reset passwords, email one or all users, search by username,etc. Does anyone know where to point me?
View 5 Replies
Jan 2, 2011
am trying to write an HttpModule that will work in IIS7 with integrated pipeline mode AppPool. Within this module I need to access Session variables and to be able to capture the Session Start and End events. I have found a couple of articles on this topic that indicate the need to modify the behavior of the HttpHandler in PostAcquireRequestState to force the Session for the context to be initialized. The article I am using as a template is posted here:[URL]In my case I am getting the following error:
[NullReferenceException: Object reference not set to an instance of an object.] System.Web.PipelineModuleStepContainer.GetEventCount(RequestNotification notification, Boolean isPostEvent) +30 System.Web.PipelineStepManager.ResumeSteps(Exception error) +1112
System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb) +113 System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +616
I believe that this error implies a problem with attempting to attach an event handler multiple times. I am aware that the modules Init function can be called more than once and have set a static initialization flag which ensures that I will only ever attach the event handler once.In the most condensed form my code is as follows:
public class HttpModule : IHttpModule, IRequiresSessionState
View 1 Replies
Feb 1, 2010
[Code]....
Dump Mail To An SMTP Pickup Directory-Only Getting 1 email-Expect All
View 6 Replies
Jan 27, 2010
i have a form that my i use to look up whether or not there is an email address in the database. i wrote a query with this basic structure:
select *
from table A, table B
where table A.email = "email" or table b = "email"
i though that would return all instances that the email occurred in either table. what i am getting back is a bunch of null or other unrelated records from table A with a matching email in table B. the thing is, these two tables primary key to join them. i thought i wouldnt need to do that though in this case.
here is the actually query i am using if it makes things more clear:
select lm.cemailaddr, lm.b1emailadd, b.emailaddr
View 4 Replies
Jan 18, 2010
We have an SharePoint site no login (anonymous) with a search module using AJAX. Now the users complains that the module isn't working. When I check the code (not developed by me), I find that the code only runs if "HttpContext.Current.User.Identity.IsAuthenticated=true". Could that ever return true on an anonymous site?
View 1 Replies
Jun 16, 2010
providing template or sample code to manage users from Client side.
My Environment Details:-
Framework: 3.5
Code Behind: C#
Membership/Roles Provider: SQL Server
View 3 Replies
Mar 24, 2010
I have an application that ran fine on a Win 2003 box using windows authentication. After installing the app on a 32-bit Windows Server 2008 box the users are now prompted for domain credentials every time they call the site. I went into IIS manager for IIS7 and disabled anonymous authentication and enabled windows authentication. What do I need to do here for the user to not be prompted for the credentials?
View 5 Replies
