Hi,
I need to cover by custom authentication algorithm both ASP.NET and other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET. Other
generic resources can be retrieved without beeing logged on.
I'm trying to configure the site to handle all resources via ASP.NET. Is it
possible?
My results are
a.. Things are working OK under .NET 2.0 Development Server (started from
Visual Studio 2005)
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm, *.html) are
not being authenticated.
Solved by adding ".*" extension mapping to ASP.NET
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
1.. .* - is not recognized as valid extension
2.. After mapping .htm to ASP.NET - .htm pages are not served anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
Or probably there is some other better way to imlement custom authentication
instead of FormsAuthentication?
Best regards,
Sergey.
8  3874 
Why not just rename the .htm files as .aspx files?
"Sergey V" wrote:
Hi,
I need to cover by custom authentication algorithm both ASP.NET and other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET. Other
generic resources can be retrieved without beeing logged on.
I'm trying to configure the site to handle all resources via ASP.NET. Is it
possible?
My results are
a.. Things are working OK under .NET 2.0 Development Server (started from
Visual Studio 2005)
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm, *.html) are
not being authenticated.
Solved by adding ".*" extension mapping to ASP.NET
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
1.. .* - is not recognized as valid extension
2.. After mapping .htm to ASP.NET - .htm pages are not served anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
Or probably there is some other better way to imlement custom authentication
instead of FormsAuthentication?
Best regards,
Sergey.
Yes,
this will work for *.htm files - though we have plenty of them in legacy
site. And proper configuration of the site will make much less headache.
But what about *.doc and *.xls files? The question is about any resource
within protected folders in general.
"clickon" <cl*****@discussions.microsoft.comwrote in message
news:DC**********************************@microsof t.com...
Why not just rename the .htm files as .aspx files?
"Sergey V" wrote:
>Hi,
I need to cover by custom authentication algorithm both ASP.NET and other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET.
Other
generic resources can be retrieved without beeing logged on.
I'm trying to configure the site to handle all resources via ASP.NET. Is
it
possible?
My results are
a.. Things are working OK under .NET 2.0 Development Server (started
from
Visual Studio 2005)
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm, *.html)
are
not being authenticated.
Solved by adding ".*" extension mapping to ASP.NET
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
1.. .* - is not recognized as valid extension
2.. After mapping .htm to ASP.NET - .htm pages are not served
anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error
code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
Or probably there is some other better way to imlement custom
authentication
instead of FormsAuthentication?
Best regards,
Sergey.
The standard way to do this is to map the extensions you want served by
ASP.NET to ASP.NET in the script mappings in IIS (or just use a wildcard
map). Then, in your web.config file, you map the static file extensions to
the StaticFileHandler in the httpHandlers config section.
There are some drawbacks to doing this, but it will work for the most part.
IIS 7 makes this super easy.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net
--
"Sergey V" <se******@mail.ruwrote in message
news:uJ**************@TK2MSFTNGP03.phx.gbl...
Yes,
this will work for *.htm files - though we have plenty of them in legacy
site. And proper configuration of the site will make much less headache.
But what about *.doc and *.xls files? The question is about any resource
within protected folders in general.
"clickon" <cl*****@discussions.microsoft.comwrote in message
news:DC**********************************@microsof t.com...
>Why not just rename the .htm files as .aspx files?
"Sergey V" wrote:
>>Hi,
I need to cover by custom authentication algorithm both ASP.NET and
other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET.
Other
generic resources can be retrieved without beeing logged on.
I'm trying to configure the site to handle all resources via ASP.NET. Is
it
possible?
My results are
a.. Things are working OK under .NET 2.0 Development Server (started
from
Visual Studio 2005)
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm, *.html)
are
not being authenticated.
Solved by adding ".*" extension mapping to ASP.NET
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
1.. .* - is not recognized as valid extension
2.. After mapping .htm to ASP.NET - .htm pages are not served
anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error
code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
Or probably there is some other better way to imlement custom
authentication
instead of FormsAuthentication?
Best regards,
Sergey.
Thanks Joe,
adding following to web.config really helps.
<system.web>
<httpHandlers>
<add path="*.htm" verb="GET,HEAD"
type="System.Web.StaticFileHandler" validate="True" />
</httpHandlers>
</system.web>
Can you provide more details about drawbacks? Do not want to have some
surpises on production site.
Thanks,
Sergey.
PS: MS is very short in his docs as usual.
Frequently Asked Questions http://msdn.microsoft.com/asp.net/su...q/default.aspx
Configuring ASP.NET 2.0
I used the ASP.NET configuration system to restrict access to my ASP.NET
application, but anonymous users can still view some of my files. Why is
that?
The features of the ASP.NET configuration system only apply to ASP.NET
resources. For example, Forms Authentication only restricts access to
ASP.NET files, not to static files or ASP (classic) files unless those
resources are mapped to ASP.NET file name extensions. Use the configuration
features of IIS to configure non-ASP.NET resources.
How do we use configuration features of IIS for this purpose? No details.
"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.comwrote
in message news:e0**************@TK2MSFTNGP03.phx.gbl...
The standard way to do this is to map the extensions you want served by
ASP.NET to ASP.NET in the script mappings in IIS (or just use a wildcard
map). Then, in your web.config file, you map the static file extensions
to the StaticFileHandler in the httpHandlers config section.
There are some drawbacks to doing this, but it will work for the most
part.
IIS 7 makes this super easy.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Sergey V" <se******@mail.ruwrote in message
news:uJ**************@TK2MSFTNGP03.phx.gbl...
>Yes,
this will work for *.htm files - though we have plenty of them in legacy
site. And proper configuration of the site will make much less headache.
But what about *.doc and *.xls files? The question is about any resource
within protected folders in general.
"clickon" <cl*****@discussions.microsoft.comwrote in message
news:DC**********************************@microso ft.com...
>>Why not just rename the .htm files as .aspx files?
"Sergey V" wrote:
Hi,
I need to cover by custom authentication algorithm both ASP.NET and
other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET.
Other
generic resources can be retrieved without beeing logged on.
I'm trying to configure the site to handle all resources via ASP.NET.
Is it
possible?
My results are
a.. Things are working OK under .NET 2.0 Development Server (started
from
Visual Studio 2005)
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm,
*.html) are
not being authenticated.
Solved by adding ".*" extension mapping to ASP.NET
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
1.. .* - is not recognized as valid extension
2.. After mapping .htm to ASP.NET - .htm pages are not served
anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error
code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
Or probably there is some other better way to imlement custom
authentication
instead of FormsAuthentication?
Best regards,
Sergey.
Hi,
on IIS 6 just add a wildcard mapping for ASP.NET - that's on the same dialog
where you add individual mappings -
add an entry that points to the 2.0 aspnet_isapi.dll - also uncheck "verify
that file exists"
afterwards you should remove the individual mappings, you also don't need
any handler mapped to .htm in web.config then.
this makes ASP.NET handle all requests in a very efficient fashion.
I don't see any drawback here.
dominick
The standard way to do this is to map the extensions you want served
by ASP.NET to ASP.NET in the script mappings in IIS (or just use a
wildcard map). Then, in your web.config file, you map the static file
extensions to the StaticFileHandler in the httpHandlers config
section.
There are some drawbacks to doing this, but it will work for the most
part.
IIS 7 makes this super easy.
Joe K.
The drawbacks that I'm aware of are that it is much slower to route things
through ASP.NET that IIS could have handled directly. If performance is an
issue, you might want to test in this scenario and make sure you are still
meeting your stated perf goals.
As I recall, there is another functional drawback, but I can't actually
remember what it is. :) I don't think it is a major issue though. I'm
basically agreed with Dominick on this one.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net
--
"Sergey V" <se******@mail.ruwrote in message
news:eF**************@TK2MSFTNGP04.phx.gbl...
Thanks Joe,
adding following to web.config really helps.
<system.web>
<httpHandlers>
<add path="*.htm" verb="GET,HEAD"
type="System.Web.StaticFileHandler" validate="True" />
</httpHandlers>
</system.web>
Can you provide more details about drawbacks? Do not want to have some
surpises on production site.
Thanks,
Sergey.
PS: MS is very short in his docs as usual.
Frequently Asked Questions
http://msdn.microsoft.com/asp.net/su...q/default.aspx
Configuring ASP.NET 2.0
I used the ASP.NET configuration system to restrict access to my ASP.NET
application, but anonymous users can still view some of my files. Why is
that?
The features of the ASP.NET configuration system only apply to ASP.NET
resources. For example, Forms Authentication only restricts access to
ASP.NET files, not to static files or ASP (classic) files unless those
resources are mapped to ASP.NET file name extensions. Use the
configuration features of IIS to configure non-ASP.NET resources.
How do we use configuration features of IIS for this purpose? No details.
"Joe Kaplan (MVP - ADSI)" <jo*************@removethis.accenture.comwrote
in message news:e0**************@TK2MSFTNGP03.phx.gbl...
>The standard way to do this is to map the extensions you want served by
ASP.NET to ASP.NET in the script mappings in IIS (or just use a wildcard
map). Then, in your web.config file, you map the static file extensions
to the StaticFileHandler in the httpHandlers config section.
There are some drawbacks to doing this, but it will work for the most
part.
IIS 7 makes this super easy.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services
Programming"
http://www.directoryprogramming.net
--
"Sergey V" <se******@mail.ruwrote in message
news:uJ**************@TK2MSFTNGP03.phx.gbl...
>>Yes,
this will work for *.htm files - though we have plenty of them in legacy
site. And proper configuration of the site will make much less headache.
But what about *.doc and *.xls files? The question is about any resource
within protected folders in general.
"clickon" <cl*****@discussions.microsoft.comwrote in message
news:DC**********************************@micros oft.com...
Why not just rename the .htm files as .aspx files?
"Sergey V" wrote:
Hi,
>
I need to cover by custom authentication algorithm both ASP.NET and
other
resources within the site.
FormsAuthentication covers only resources beeing handled by ASP.NET.
Other
generic resources can be retrieved without beeing logged on.
>
I'm trying to configure the site to handle all resources via ASP.NET.
Is it
possible?
>
My results are
>
a.. Things are working OK under .NET 2.0 Development Server (started
from
Visual Studio 2005)
>
>
b.. Under local WinXP IIS - non-ASP.NET resources (like *.htm,
*.html) are
not being authenticated.
>
Solved by adding ".*" extension mapping to ASP.NET
>
>
c.. Under WinSrv 2003 SP1 / IIS6 there are following problems
>
1.. .* - is not recognized as valid extension
>
2.. After mapping .htm to ASP.NET - .htm pages are not served
anymore.
a.. Browser shows completely blank page
b.. HTTP Watch tracks ERROR_HTTP_INVALID_SERVER_RESPONSE error
code,
response stream is empty
c.. IIS log on the server gives error code 200, i.e. OK
Any ideas to configure this correctly under WinSrv 2003?
>
Or probably there is some other better way to imlement custom
authentication
instead of FormsAuthentication?
>
>
>
Best regards,
>
Sergey.
>
>
>
the perf drawback is in 1.1 and IIS5
In 2.0 they use a new feature that bounces back requests in HandlerExecute
to IIS6 to serve them
Pre and Post Events still run - which is kinda close to whats happening in
IIS 7.
dominick
The drawbacks that I'm aware of are that it is much slower to route
things through ASP.NET that IIS could have handled directly. If
performance is an issue, you might want to test in this scenario and
make sure you are still meeting your stated perf goals.
As I recall, there is another functional drawback, but I can't
actually remember what it is. :) I don't think it is a major issue
though. I'm basically agreed with Dominick on this one.
Joe K.
Cool, good to know.
Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net
--
"Dominick Baier" <dbaier@pleasepleasenospam_leastprivilege.comwro te in
message news:45*************************@news.microsoft.co m...
the perf drawback is in 1.1 and IIS5
In 2.0 they use a new feature that bounces back requests in HandlerExecute
to IIS6 to serve them
Pre and Post Events still run - which is kinda close to whats happening in
IIS 7.
dominick
This thread has been closed and replies have been disabled. Please start a new discussion. Similar topics
by: Kris van der Mast |
last post by:
Hi,
I've created a little site for my sports club. In the root folder there are
pages that are viewable by every anonymous user but at a certain subfolder
my administration pages should be...
|
by: francois |
last post by:
hello,
I am using forms authentication and I would like that my authentication
cookie expires after let say 1 minutes (just for the exemple).
When I log in in my longon page, the user has to...
|
by: Travis Parrent |
last post by:
I'm having a problem where my application forces the user to log on
intially, but then never forces them to reauthenticate. Following is the
login code currently but I've tried several different...
|
by: Anonieko Ramos |
last post by:
ASP.NET Forms Authentication Best Practices
Dr. Dobb's Journal February 2004
Protecting user information is critical
By Douglas Reilly
Douglas is the author of Designing Microsoft ASP.NET...
|
by: CW |
last post by:
It's recommended that when signing on using FormsAuthentication, one should
do so over a secure (SSL) channel.
If I understand FormsAuthentication mechanism correctly, the Authentication
ticket...
|
by: Manny Chohan |
last post by:
I am using forms authetication in the web config. i can validate a user
against a database and click on images which makes hidden panels
visible.However when i click on the link inside a panel...
|
by: Justin |
last post by:
I am trying to password protect a subdirectory using forms authentication. I
am using the "Location" tag to specify the directory to be protected. The
login.aspx page is in the root directory of...
|
by: Randall Parker |
last post by:
Some questions on forms authentication:
1) Can one do one's own checking of username and password and totally bypass calling
FormsAuthentication.Authenticate?
2) does the "new...
|
by: Mark Olbert |
last post by:
I'm building an ASPNET2 website which uses forms authentication but does not use the Microsoft-supplied membership providers (mostly
because I don't want to create my own provider at this point, and...
|
by: Charles Arthur |
last post by:
How do i turn on java script on a villaon, callus and itel keypad mobile phone
|
by: ryjfgjl |
last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
|
by: BarryA |
last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
|
by: nemocccc |
last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
|
by: Hystou |
last post by:
There are some requirements for setting up RAID:
1. The motherboard and BIOS support RAID configuration.
2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...
|
by: marktang |
last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However,...
|
by: Oralloy |
last post by:
Hello folks,
I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>".
The problem is that using the GNU compilers,...
|
by: jinu1996 |
last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
|
by: Hystou |
last post by:
Overview:
Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...
| |
