IIS 7.5 - 403 Forbidden

Question

Ok, I have scoured online resources and applied all the suggested solutions.

I am setting up a simple website on Windows Server 2008 R2 under IIS 7.5 using the "ASP.NET v4.0" pool. I am setting this up as an application under Default Web Site with a different root. I keep getting the 403 Forbidden error.

I have:

Installed asp.net using aspnet_regiis.exe -i (many times)
Made sure my root directory (physical path) has permissions for "IIS_IUSR" and "IUSR" users.
Made sure "Anonymous Authentication" is enabled and set to "Application Pool Identity"
I have restarted IIS numerous times
I have checked and double-checked every other configuration.

What's strange is that I have another application under Default Web Site and it works just fine.

Any suggestions will help. This shouldn't be so hard unless I am missing something obvious.

Questions on professional server- or networking-related infrastructure administration are off-topic for Stack Overflow unless they directly involve programming or programming tools. You may be able to get help on Server Fault. — mcphersonjr, Jan 08 '16 at 19:31
I disagree. IIS is a programming tool, and ServerFault does not help for anything programming related like configuring IIS for an app that is being programmed. — Doug Null, Feb 23 '19 at 18:02

score 37 · Accepted Answer · answered Jun 20 '12 at 13:18

37

Ok, I am quite embarrassed but the over sight was that "Require SSL" was checked by default and that is the place I did not check. I guess it is because an SSL is bound to the Default Web Site. Removing that check made it work.

Hopefully this will help someone else.

answered Jun 20 '12 at 13:18

dotnetster

1,601
1
16
19

I came to a similar problem and noticed the same port was in use for a different matter – DanielV Sep 03 '15 at 09:08
What if you want require https checked? I have a site which has a redirect attribute filter and I want it to always be https – Zapnologica Oct 15 '15 at 03:45
After trying everything I checked the SSL settings and I had the same requirement set. D'oh! – Lee Apr 03 '17 at 13:16

bendecko · Answer 2 · 2023-08-08T14:25:58.590

25

Haha you think that is embarrasing! This is probably the 1000th webserver I've installed... 30mins of 403s!! I can't figure it out. There is a stub default.asp in there.. permissions all correct... everything!

I turned on "directory" browsing in desparation of flicking around.

default.asp.txt is sitting there..... DOH.

Need to turn OFF "known file types"... why is that setting like that anyway?

edited Aug 08 '23 at 14:25

answered Jun 04 '15 at 08:57

bendecko

2,643
1
23
33

3

Yes, those hidden file types be darned. – mortb Jun 29 '15 at 14:27
This answer just saved me hours of lost time trying to find the source of the problem. Thanks – Ahmad May 09 '16 at 12:08
1

I have no idea why that option is enabled even on windows data center 2016 – Simon_Weaver Apr 01 '17 at 06:13
Dude... wow. Saved my life man! Every... Freaking... Time... I am working on a new windows machine. – Tyler Aug 20 '17 at 16:10
I was about to downvote this answer, as this is more a comment than a real answer. But, man... you've just saved my day... – Renan Vasconcelos Jun 04 '18 at 17:21
That is the first thing I turn off when I install any Windows OS on a new machine or a new AMI – Najeeb Jul 31 '18 at 11:49
Just swinging by to say.... yup, this was me today. New server, setting up placeholder site, hadn't checked "View File Extensions" yet. +1 – BLSully Jun 11 '20 at 13:37
This is exactly it right here and needs a thousand up votes. I wish the answer was given more directly to catch the attention. – llessurt May 17 '23 at 17:41

score 9 · Answer 3 · answered Nov 16 '16 at 11:52

9

Another possible issue which leads to a 403 error:

The Global.asax file is missing.

answered Nov 16 '16 at 11:52

Raidri

17,258
9
62
65

score 7 · Answer 4 · answered Nov 10 '15 at 20:17

For me the answer was in handler mappings section of IIS 7.5

Adding the following to web.config enabled all the aspx pages to work correctly

<configuration>
...
  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <handlers accessPolicy="Read, Script" />
    ... 
  </system.webServer>
</configuration>

Jupaol · Answer 5 · 2012-06-20T02:14:14.863

3

Grant permission to the Network Service user in the NTFS folder

Also check the .Net authorization rules:

enter image description here

edited Jun 20 '12 at 02:14

answered Jun 20 '12 at 02:09

Jupaol

21,107
8
68
100

3

I have specified the app pool user as "ApplicationPoolIdentity" which is a virtual user in my case like "IIS AppPool\ASP.NET v4.0". Therefore, Network Service user permissions should not matter. Plus IIS_IUSR includes all app pool users. The authorization rules are fine. – dotnetster Jun 20 '12 at 02:24
2

The screencap is so small that I'm not really even sure what menu this is. – Alkanshel Aug 22 '15 at 00:02

score 1 · Answer 6 · answered Sep 21 '16 at 11:06

1

Check that IP address restrictions are not blocking the request. Can check this in the logs.

(This was my embarrassing reason!)

answered Sep 21 '16 at 11:06

GlennG

2,982
2
20
25

score 1 · Answer 7 · answered Aug 31 '18 at 05:06

1

Mine was even more embarrassing.

Right Click on folder,Remove READ only attribute.

answered Aug 31 '18 at 05:06

KumarHarsh

5,046
1
18
22

score 0 · Answer 8 · answered Feb 26 '19 at 18:29

0

For me, there was a vestigial Web.config in C:\inetpub\wwwroot with rewrite rules. Deleting it solved the problem.

answered Feb 26 '19 at 18:29

Eric Eskildsen

4,269
2
38
55

score 0 · Answer 9 · answered Mar 27 '19 at 15:43

0

I was facing issue on windows 7 and surprisingly it was fixed after installing service pack 1

answered Mar 27 '19 at 15:43

Naveed Yousaf

436
4
14

score 0 · Answer 10 · answered May 13 '19 at 04:32

You might also get this if setting up FTP for a website and you try and change the default directory for FTP on the website.

From what I can tell:

Manage FTP Site -> Advanced Settings -> Physical Path

is the same

Manage Website -> Advanced Settings -> Physical Path

Changing one will change the other and possibly cause a 403 on a working site.

IIS 7.5 - 403 Forbidden

10 Answers10

Linked