MVC4 HTTP Error 403.14 - Forbidden

Question

I have build a .net4.5 ASP.NET MVC4 web app which works fine locally (IIS Express & dev server) but once i deploy it to my web server it throws the 403 error. I have installed .Net 4.5RC on the server and even tried the aspnet_regiis -i bit that everyone recommended for their issues with previous versions of MVC/.Net but it did not help.

Any ideas?

EDIT: More info about the situation. The server is 32bit and I have 4 other MVC3 applications that work fine. It is just my MVC4 app that is not working.

I ran into this same problem when I created a new asp.net 4.5 **Web Forms** app. It worked fine locally (IIS 7.5), but when deployed to test server (also IIS 7.5) then most all of my bundled & minified javascript and css files were failing to load with 404 Not Found. The answer below about runAllManagedModulesForAllRequests solved the problem for me! — Jason Parker, Oct 02 '12 at 16:26
I may have answered this question at: http://stackoverflow.com/questions/24343788/upgrade-to-asp-net-mvc-5-error-403-14-forbidden/24392697#24392697 — fsbf, Jun 24 '14 at 17:29

score 172 · Accepted Answer · edited Apr 13 '17 at 12:13

172

Try

<system.webServer>
   <modules runAllManagedModulesForAllRequests="true"/> 
 </system.webServer>

Via

https://serverfault.com/questions/405395/unable-to-get-anything-except-403-from-a-net-4-5-website

edited Apr 13 '17 at 12:13

Community

1
1

answered Jul 11 '12 at 15:07

MarkKGreenway

8,494
5
34
53

1

Had that in place, did everything, and still only MVC 4 sites work. There has to be some other trick that needs to be in place for this to work. – Maxim V. Pavlov Aug 17 '12 at 10:52
1

This. Tried all the other stock solutions with no joy but this was the one that sorted the problem. – Julia Hayward Jan 02 '13 at 09:39
1

Dear friend, I do it, but it doesn't work. Really, I was working with MVC 4 and VisualStudio 2012, my project works well until yesterday, but after some usual changes in my codes, this error rise in default page (home/index). can any body help me please?.. – A.Dara Feb 17 '14 at 07:46
4

This fix is **Not appropriate** for this problem (see the link in Jason Koopmans answer). much better is downloading the related hotfix here http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=5272 – Ahmad Ibrahim Mar 26 '14 at 11:39
@AhmadIbrahim it is in fact a solution to the problem. The fix is for 64bit only, the question clearly states 32bit. There are certain configurations for which RAMMFAR is the most reliable working solution, and adds minimal server load if CDN's are appropriately used. – MarkKGreenway Apr 25 '14 at 16:20
@MarkKGreenway I think there's a 32-bit version of the fix here http://www.microsoft.com/en-us/download/details.aspx?id=11342 – Ahmad Ibrahim May 07 '14 at 14:23
@MarkKGreenway you think that this case is one of the _certain configurations for which RAMMFAR is the most reliable working solution_ ? – Ahmad Ibrahim May 07 '14 at 14:25
This was our fix for Server 2002 and IIS 7. Our lower environments are Server 2012 with IIS 8, we deployed without setting the modules `runAllManagedModulesForAllRequests="true"`. Luckily after getting the 403 many times and more stackoverflow searching I found this thread. So, setting `runAllManagedModulesForAllRequests="true"` on Server 2002 with IIS 7 solve our problems....and made for a long deployment night. – chdev77 Jul 16 '15 at 23:52
-1 No attempt to explain why the solution works, link itself doesn't even explain it. Bad solution in general (huge performance penalty, not scalable). You should almost never need RAMMFAR other than debugging purposes. – Slight Feb 05 '16 at 17:10
@Slight RAMMFAR only has negative impact on things that would not be delivered via asp.net such as static content other modules. More info : http://weblog.west-wind.com/posts/2012/Oct/25/Caveats-with-the-runAllManagedModulesForAllRequests-in-IIS-78 – MarkKGreenway Feb 05 '16 at 21:12
@MarkKGreenway Yes, that's what I was referring to. Is that not what's happening here? With that option on, static files will invoke the pipline no? – Slight Feb 09 '16 at 21:06
@MarkKGreenway you saved my neck. I had **ALL** of my MVC sites go down and doing this fixed it. A lynch mob was forming but then I found your answer *phew*! What I'd like to know, though, is what could have changed on my server to make this necessary since all sites were working before... – Ortund Jun 08 '17 at 19:37
@MarkKGreenway you saved my neck. I had **ALL** of my MVC sites go down and doing this fixed it. A lynch mob was forming but then I found your answer *phew*! What I'd like to know, though, is what could have changed on my server to make this necessary since all sites were working before... – Ortund Jun 08 '17 at 19:37

score 22 · Answer 2 · edited May 23 '17 at 11:47

22

Error 403.14 is the HTTP error code for not being allowed to list the contents of a directory. Please be sure that

You have setup the website as an application in IIS
You have .NET 4.5 installed on the server
You have set the application pool to run the proper version of the .NET framework (ie. it is not set to .NET 2.0
You are using the integrated pipeline on your application pool
.NET 4.5 is actually registered in IIS. Please see this post for a similar issue/resolution

Usually, a and d are the biggest issues surrounding MVC deployments to IIS

edited May 23 '17 at 11:47

Community

1
1

answered Jul 11 '12 at 13:13

Tommy

39,592
10
90
121

1. I have not setup the website as an application. 2. I have .net 4.5 installed, 3.had my app pool targeting the correct framework. 4. My pool was set to use classic, changed it to Integrated but didn't help. 5. I am pretty sure 4.5 is registered. – mithun_daa Jul 11 '12 at 13:29
1

@mithun_daa - If you have not setup your website as an application, its pretty easy -> right click the virtual directory/website and Convert To Application (or add Application, terminology escapes me at the moment) – Tommy Jul 11 '12 at 13:32
Is this a MVC4 specific thing? Cause I have never set up my MVC3 projects as Applications and they work just fine. – mithun_daa Jul 11 '12 at 13:52
Could be how you are deploying then -> but any .NET web application must be set as an application in IIS. However, if you are just putting these under the default website, then it is running under the default website application. Make sure that the application pool of the default website is configured correctly (.NET 4/integrated). When you create a virtual directory/virtual website in IIS, you have the option of setting it to its own application as well. – Tommy Jul 11 '12 at 14:23
I probably confused you but none of the sites are under the Default Web site. I right click "Sites" in IIS7 and choose "Add Web Site". That is how i have been doing. – mithun_daa Jul 11 '12 at 14:32
I don't feel this is worth an answer on it's own, but make sure you haven't accidentally added a folder to your site at one of your controller routes :). – Ishmael Sep 21 '16 at 14:29

score 12 · Answer 3 · answered Apr 09 '14 at 18:48

12

Perhaps... If you happen to use the Publish Wizard (like I did) and select the "Precompile during publishing" checkbox (like I did) and see the same symptoms...

Yeah, I beat myself over the head, but after unchecking this box, a seemingly unrelated setting, all the symptoms described go away after redeploying.

Hopefully this fixes some folks.

answered Apr 09 '14 at 18:48

Brian Kirkpatrick

151
1
2

If you are having this a possible root cause is having a different version of an external library in the production environment. I had my mvc app compiled against a newer version of a 3rd party dll and an older version in the production server.. – ValGe Mar 14 '17 at 16:17
Here's to the boy wonder, the kid, the miracle man, the phenomenon, the unstoppable, the king, here's to @Brian Kirkpatrick ladies and gentleman – Luis Villarroel Feb 13 '19 at 23:05

score 10 · Answer 4 · answered Nov 29 '16 at 00:26

10

Windows-> Start -> Turn widows features on and off

Make sure you check required options in

answered Nov 29 '16 at 00:26

Kurkula

6,386
27
127
202

score 6 · Answer 5 · answered Feb 13 '14 at 17:51

Before applying

runAllManagedModulesForAllRequests="true"/>

consider the link below that suggests a less drastic alternative. In the post the author offers the following alteration to the local web.config:

  <system.webServer>
    <modules>
    <remove name="UrlRoutingModule-4.0" />
    <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
    </modules>

http://www.britishdeveloper.co.uk/2010/06/dont-use-modules-runallmanagedmodulesfo.html

This is the real answer. Thanks! – Spivonious Aug 22 '16 at 19:17 — Spivonious, Aug 22 '16 at 19:17

score 5 · Answer 6 · edited Feb 26 '18 at 19:36

5

There is a Refactor --> Rename Bug in Visual Studio 2012 that wrongly renamed the "id" inside the literal string value of the url parameter in my RouteConfig.cs. This caused a 403.14 on a fresh and otherwise correct setup in both Windows Server 2012 and Windows Server 2008 R2.

routes.MapRoute(
    name: "Default",
    url: "{controller}/{action}/{id}",
    defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional }
);

was changed to

routes.MapRoute(
    name: "Default",
    url: "{controller}/{action}/{renamed_text}",
    defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional }
);

edited Feb 26 '18 at 19:36

answered Dec 18 '13 at 16:47

user641770

101
1
2

For me, I discovered long ago that I can enter `null` for the `name` parameter to avoid making up a name for every route. It turns out that this also causes a 403 sometimes (only on our prod environment, Win Server 2008 R2 running .NET 4.5.1, MVC 5 in a VS2013 project. To resolve I added a name for each route. – tristankoffee Feb 19 '15 at 14:29

Mastro · Answer 7 · 2015-08-07T16:52:56.250

2

If you're running IIS 8.5 on Windows 8, or Server 2012, you might find that running mvc 4/5 (.net 4.5) doesn't work in a virtual directory. If you create a local host entry in the host file to point back to your local machine and then point a new local IIS website to that folder (with the matching host header entry) you'll find it works then.

edited Aug 07 '15 at 16:52

answered Apr 29 '14 at 02:21

Mastro

1,477
2
22
52

Why post the [same answer](http://stackoverflow.com/a/23354373/2235132) at multiple places? – devnull Apr 29 '14 at 02:58
8

Because I was trying to track down the solution, and it pertains to both. Save someone from hunting it around. – Mastro Apr 29 '14 at 16:45
You shouldn't be posting duplicate answers. That's all I can say. – devnull Apr 29 '14 at 16:47

score 2 · Answer 8 · answered Jul 23 '14 at 18:54

2

You can also get a 403 if when testing with dev server you are using integrated pipeline and then install as classic pipeline mode on your live IIS 7.5 web server, also I was missing my app_data folder which also was required

answered Jul 23 '14 at 18:54

marcusdev

21
1

score 1 · Answer 9 · answered Apr 09 '15 at 14:42

1

<system.webServer>
   <modules runAllManagedModulesForAllRequests="true"/> 
 </system.webServer>

U can use above code

answered Apr 09 '15 at 14:42

Jinto John

365
4
22

score 1 · Answer 10 · answered Apr 15 '15 at 13:32

I had set the new app's application pool to the DefaultAppPool in IIS which obviously is using the Classic pipeline with .NET v.2.0.

To solve the problem I created a new App Pool using the Integrated pipeline and .NET v4.0. just for this new application and then everything started working as expected.

Don't forget to assign this new app pool to the application. Select the application in IIS, click Basic Settings and then pick the new app pool for the app.

score 1 · Answer 11 · answered Aug 30 '16 at 12:27

In my case the issue was caused by custom ActionFilterAttribute which was a kind of global filter attribute. The attribute instantiated a service through Autofac but the service crashed in constructor:

public ActionFilterAttribute()
{
    _service = ContainerManager.Resolve<IService>();
}

public class Service: IService
{ 
    public Service()
    {
        throw new Exception('Oops!');
    }
}

score 0 · Answer 12 · answered Jul 11 '12 at 05:52

0

the one i see more frequently recently is IIS and allowing 32bit applications to run

Is this what you have tried. otherwise we need more information about production and dev server versions

answered Jul 11 '12 at 05:52

MarkKGreenway

8,494
5
34
53

I am sorry but i did not follow what you meant. This is a 32bit server. I have updated my post to add more info. – mithun_daa Jul 11 '12 at 13:20
Ahhh ... Are they in separate app_pools? – MarkKGreenway Jul 11 '12 at 13:58
Yes, infact each of my sites have their own app pools. – mithun_daa Jul 11 '12 at 14:07

score 0 · Answer 13 · answered Mar 04 '13 at 23:27

0

I have a bit different issue, on server 2012 somehow i forgot to enable asp.net 4.5 so if you have this issue, double check that you enable it.

answered Mar 04 '13 at 23:27

Vova Bilyachat

18,765
4
55
80

score 0 · Answer 14 · answered Jun 27 '14 at 16:10

I'm running Windows Server 2012 R2 on Azure and ASP.NET 4.5, IIS 8

I solved this problem by uninstalling all of the ASP.NET items in Programs and Features, then reinstalling ASP.NET like this with Server Manager using Add Roles and Features: picked Role-Based or Feature-Based installation, picked my server, and then for Select Server Role picked Web Server (IIS)/Web Server/Application Development, then clicked ASP.NET 4.5, confirmed installation of a prerequisite, and then reinstalled ASP.NET 4.5.

My previous searches had lead me to believe that the problem actually stems from a registration problem with ASP.NET. With earlier versions of ASP.NET, there is actually a utility that you can run to register ASP.NET without reinstalling, but that doesn't seem to be available any longer.

score 0 · Answer 15 · answered May 21 '15 at 19:51

0

I solve the problem opening the visual studio, expanding the references and changing the property "Copy Local" to "True".

I discover this comparing the dlls of the old version with the Dlls of my new version (that was not working)

answered May 21 '15 at 19:51

Wagner

1

score 0 · Answer 16 · answered Apr 18 '16 at 15:22

0

In my case, my application's default page was index.html which was missing from the default document options. Adding it fixed the 403.14 Forbidden error.

answered Apr 18 '16 at 15:22

Erik K.

1,024
12
13

score 0 · Answer 17 · edited Feb 26 '18 at 19:20

In my case neither Windows Features nor aspnet_regiis -i didn't do the work. After hours of digging in the Internet, I made my own solution:

In the IIS Manager in Modules I changed inherit to local in UrlRoutingModule-4.0 node:

In web.config I pasted a mix of some tips from this forum:

<system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
        <remove name="UrlRoutingModule-4.0"></remove>
        <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition=""></add>
    </modules>
</system.webServer>

Hope it helps

score 0 · Answer 18 · answered Aug 26 '21 at 18:03

Either I inadvertently changed my application pool .NET CLR Version to: No Managed Code OR it was changed when I changed the application pool for my new .NET 5 web app that I deployed on the same server.

Changing my application pool .NET CLR Version back to: .NET CLR Version v4.0.30319 resolved the issue.

MVC4 HTTP Error 403.14 - Forbidden

18 Answers18

Linked

Related