Re: Can I force 401 error when user not authenticated?

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 04/24/04

  • Next message: Ken Schaefer: "Re: Forms Auth Problems." 
    Date: Sat, 24 Apr 2004 16:07:20 +1000

    Hi

    When using forms authentication, you are never sending back a 403 header.
    You are just redirecting the user to another ASP.NET page. A 403 header
    forces the browser to use HTTP authentication (e.g. Basic, IWA, Digest etc).

    Forms auth never involves these HTTP status codes - all pages are 200 OK. It
    is at the application layer (of your ASP.NET app) that you enforce
    authentication, not at the lower HTTP level.

    Cheers
    Ken

    "Bigtoga" <bigtoga@maratrane.com> wrote in message
    news:BM9ic.11313$004.293@newssvr31.news.prodigy.com...
    : Currently I have succesfully implemented role-based folder security using
    : roles and web.config in each folder. This works great - if a user is not
    : authenticated or a member of an allowed role, that user cannot access the
    : resource (woohoo!). When the disallowed user tries to access the resource,
    : it redirects them to a login page.
    :
    : What I want is that, when an unauthorized user tries to access a secure
    : resource, I want it to raise a 401 error (which would then call my 401
    : customer error page).
    :
    : Can I do this?
    :
    : In my web.config for the application, I have:
    :
    : <forms name="Auth" loginUrl="login.aspx" protection="All" path="/"/>
    :
    : If the user fails, it auto-redirects to login.aspx.
    :
    :
    :
    : I tried this:
    :
    : <forms name="Auth" protection="All" path="/"/> <!-- loginUrl omitted-->
    :
    : And rebuilt then restarted the webserver - same thing.
    :
    :
    :
    : How can I set it up so that unathorized requests raise a 403 error? i have
    : this in web.config as well...
    :
    : <customErrors mode="On" defaultRedirect="/errors/404.aspx">
    :
    : <error statusCode="400" redirect="/errors/400.aspx"/><!--400 (Bad
    : Request)-->
    :
    : <error statusCode="401" redirect="/errors/401.aspx"/><!--401
    : (Unauthorized)-->
    :
    : <error statusCode="403" redirect="/errors/403.aspx"/><!--403
    (Forbidden)-->
    :
    : <error statusCode="404" redirect="/errors/404.aspx"/><!--404 (Not
    Found)-->
    :
    : <error statusCode="500" redirect="/errors/500.aspx"/><!--500 (Internal
    : Server Error)-->
    :
    : </customErrors>
    :
    :

  • Next message: Ken Schaefer: "Re: Forms Auth Problems."

    Relevant Pages

    • Re: HTTP_AUTHORIZATION header
      ... authentication sequence. ... this in your setup by directly accessing the CGI EXE a couple of timems. ... i.e. the HTTP_AUTHORIZATION header gets sent every time ... I use WFetch to make a Basic authenticated POST request against my CGI ...
      (microsoft.public.inetserver.iis.security)
    • Re: .NET WS client connecting to Axis WS - credentials problem
      ... Http, it sets the credentials when Basic authentication or Windows ... expecting a security header in the SOAP message. ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Accessing Authenticate Header
      ... .NET HTTPModule receives request from client on the BeginRequest event, ... HTTP_AUTHORIZATION header is not included on the HTTPRequest because IIS ... > 1) IIS configuration for anonymous access ONLY (NO Basic Authentication) ... > 3) Handler or Module reads the AUTHORIZATION header and authenticates ...
      (microsoft.public.dotnet.security)
    • Re: Accessing Authenticate Header
      ... IIS configuration for anonymous access ONLY (NO Basic Authentication) ... Handler or Module reads the AUTHORIZATION header and authenticates ...
      (microsoft.public.dotnet.security)
    • Re: Accessing Authenticate Header
      ... >From my experience with building a custom authorization module, ... a basic auth header, parse it and then use the username and password from ... ability to provide authentication services. ... >> of IIS. ...
      (microsoft.public.dotnet.security)