We Keep Coding

ASP.Net 4.5 Forms Authentication / Authorization not working

I started with a default WebForms project with Individual Accounts. I have a bunch of content that I've built with database connections. I want to restrict all content to authenticated users with the exception of the default.aspx
I have successfully established the Identity table structures in my SQL database and can "register" new users. This all works fine. However, when I add the authentication setup to the web.config see below, it all breaks.
<system.web>
<authentication mode="Forms">
<forms name=".FormsAuth" loginUrl="Login.aspx" protection="All" slidingExpiration="false" requireSSL="false" />
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
<location path="Default.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
I would expect this to allow me to view my Default.aspx page and redirect if I moved off of it. Instead I attempts to redirect to \account\login and fails with this message.
HTTP Error 404.15 - Not Found The request filtering module is
configured to deny a request where the query string is too long.
The ReturnURL is huge and seems to repeat itself. I've tried looking around for a start from scratch example but have not found one that works. This should be simple.
http://localhost:58573/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FDefault

I figured this out. I had to remove the general "deny all anonymous" statement from web.config:
<!--<authorization>
<deny users="?"/>
</authorization>-->
...which I was trying to use to restrict ALL but the login page.
I moved all of my content into a few subfolders then called them out with the location tags and the same deny users statement.
<location path="System">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
<location path="Reports">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
At this point it seems to be working "properly" and now redirects users to login.aspx if not authenticated.

The \account\login.aspx was denyed because of the web.config.
...
<authorization>
<deny users="?"/>
</authorization>
When you redirect to the login page, because anonymous access is forbidden, you are redirected to the login page again, resulting in recursion.
You can create web.config in the account folder.The content is like this:
<system.web>
<authorization>
<allow users="*"/>
</authorization>

Web.Config getting authentication error

I have the following code:
My goal is that only when the user tries to go to the Register.aspx page they need to be authenticated with the Admin.aspx page.
I get the following message;
It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused ty a virtual directory not being configured as an application in IIS.
Am I doing something wrong?
<location path="Report.aspx">
<system.web>
<authentication mode="Forms">
<forms loginUrl="Admin.aspx" >
<credentials passwordFormat="Clear">
<user name="John" password="pass#432"/>
</credentials>
</forms>
</authentication>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>

Your application is probably sitting in a folder under your website as part of that website and not an application in its own right.
For IIS 6.1: Go into IIS, right click your applications root folder and select Convert to Application.
Give this a go and see if it helps.
If that dosn't work...
Check you are putting your authentication config in the root web.config file and not in one in a folder lower down. (for example the one sitting in the MVC views folders if using MVC).
Although not related to your problem, as someone else said you have a deny all. To deny unauthenticated users access to the page use the question mark instead of asterix.
<location path="foo.aspx">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>

How to solve Redirect Loop

I have a web application, and some users who use Chrome as their preferred browser of choice, get the following error when they have logged out of the application, and try to log back in.
"This webpage has a redirect loop".
My web application uses forms authentication, and the FormAuthenticationModule redirects the user back to the Login page of my application, so I cannot use this approach:
<customErrors mode="On" defaultRedirect="~/MyErrorPage.aspx" >
<error statusCode="401" redirect="~/NoAccess.aspx"/>
</customErrors>
Instead, I have added the following to the Page_Load event of my LoginPage.
if (Request.IsAuthenticated && !string.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
{
Response.Redirect("~/NoAccess.aspx");
}
However, since I have added this approach, the users seem to get the "Redirect Loop" error.
After clearing the cookies, all seems well, but the problem does occur again.
Is there a permanent fix for this I can add to my code, or is there anything else I can do to prevent this issue from happening?

Try adding this to your web.config file:
<location path="NoAccess.aspx">
<system.web>
<authorization>
<allow users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
This will turn off any authorization for this page and should stop Your loop.
You can also add this:
<location path="Login.aspx">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
This will deny access to your login page to all users that are already authenticated.
Combining those two should allow You to add custom errors for all redirections.
You may also consider creating a directory for unauthorized access (eg. public/) and placing inside all error pages (that do not require being authorized).
Then You can do:
<location path="public">
<system.web>
<authorization>
<allow users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
You can read more about location here.
And more about authorization here.

Had a very similar problem and solved it in IIS: In Authentication feature enable Anonymous Authentication and disable everything else. This makes sense, as eventually this is the application that manages authentication logic and not the IIS or ASP.NET. But obviously this solution doesn't support the elegant access to public pages as #Grzegorz suggested.

I also had a redirect loop which resulted in the error message The request filtering module is configured to deny a request where the query string is too long. for a Visual Studio 2013 Web Site where Authentication was set to Individual User Accounts.
The requested URL was a long version of http://localhost:52266/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl.... so it was obviously continually redirecting to the login page and appending the return URL each time.
No amount of of breakpoints in an attempt to find the offending loop seemed to make a difference, as none were triggered.
In the end I did the following:
Find the project properties. Do this by selecting the project (not solution) and see the Properties window (don't right-click then choose Properties, otherwise you won't find it).
Set Anonymous Authentication to Enabled.
Set Windows Authentication to Disabled.
When starting the project the default page should now appear and breakpoints you have added should start working.

It's an old post and I faced this issue while custom authentication and validation.
the issue got resolved by adding this line of code in web.config
<system.web>
<authentication mode="Forms">
<forms name=".ASPXFORMSAUTH" path="/" timeout="240" cookieless="UseCookies"></forms>
</authentication>
<authorization>
<allow users="*"/>
</authorization>
<compilation debug="true" targetFramework="4.6" />
<httpRuntime targetFramework="4.6" />
<httpModules>
<add name="ApplicationInsightsWebTracking" type="Microsoft.ApplicationInsights.Web.ApplicationInsightsHttpModule, Microsoft.AI.Web" />
</httpModules>
</system.web>
Hope it helps.

ASP.net 4 C# localhost sub domain routing

Almost all the info available on web is for MVC only. I have a subdomain called "foo" for my site "bar.com".
The folder structure is /Account/login.aspx and /Account/foo.aspx
So, when i enter foo.bar.com, I need to route to either login.aspx(if not logged in) or foo.aspx(if logged in).
I'm using asp.net web server. No IIS please.
In global.cs file :
Route Admin = new Route("admin.localhost", new CustomRouteHandler("~/Account/foo.aspx"));
routes.Add(Admin);
In my web.config
<location path="Account">
<system.web>
<authorization>
<deny users="?"/>
<allow users ="*" />
</authorization>
</system.web>
and
<authentication mode="Forms">
<forms loginUrl="~/Account/Login.aspx" name=".SAKKU" protection="All" path="/" timeout="30"/>
</authentication>
<authorization>
<!--<deny users ="?" />-->
<allow users = "*" />
</authorization>
My host file
127.0.0.1 admin.localhost
Now, whenever i type foo.bar.com, it takes me to the Default.aspx page and not the login or foo page.
Thanks,
Dev

ignore authentication for a single page

i am in a very tricky situation..
I have a page that is a part of my project and i want to access it without logging in or doing anything..
Explanation:
I have a test project which has a login page, default page, Admin folder, Guest folder, and a showmessage page.
the Admin folder has pages that are accessible to only admins
the Guest folder has pages that are accessible to all users.
now when ever i type in http://localhost/Default.aspx or any other page it first takes me to the login page and only after i enter the login credentials i go to the default page and from there to the other pages.
this system works fine for me and i dont wish to change it,
but there is this page similar to default called showmessage.aspx page.
what i want is when i type http://localhost/showmessage.aspx it should ignore all the login pages and take me directly to this page.. is there a way to do that.
i have this in my webconfig:
<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="~/Default.aspx" name="GUI" slidingExpiration="true" timeout="30" path="/">
</forms>
</authentication>
<location path="Admin" allowOverride="true">
<system.web>
<authorization>
<allow roles="Administrators" />
<deny users="*" />
</authorization>
</system.web>
</location>
Please can some1 help me.
appreciate all the help i can get. thanks

You should be able to specify the path directly to the page and allow everyone.
<location path="ShowMessage.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>