MapPageRoute routeUrl hitting 403 on specific request

Question

I currently using global.asax for my page routing on my website.

Except I have the following code:

//Home:
routes.MapPageRoute("intro", String.Empty, "~/Default.aspx");
routes.MapPageRoute("home", "home", "~/Default.aspx");

//EHBO:
routes.MapPageRoute("ehbo-overzicht", "ehbo/overzicht",  "~/ehbo/overview.aspx");
routes.MapPageRoute("ehbo-input", "ehbo/input", "~/ehbo/input.aspx");
routes.MapPageRoute("ehbo-input-edit", "ehbo/inputedit/{itemid}", "~/ehbo/inputedit.aspx");

//Links:
routes.MapPageRoute("links", "links/links", "~/links/overview.aspx");

However for Links I want to use :

//Links:
routes.MapPageRoute("links", "links", "~/links/overview.aspx");

But this isn't working for me. I'm getting the following error: HTTP-fout 403.14 - Forbidden

I am using authentication on my map ehbo, but nothing else, web.config:

<!-- Authentication -->
<authentication mode="Forms">
    <forms loginUrl="~/Login" name=".ASPXFORMSAUTH" defaultUrl="home">
    </forms>
</authentication>
<authorization>
    <allow users="*"/>
    <deny users="?" />
</authorization>

<location path="ehbo">
    <system.web>
        <authorization>
            <deny users="?"/>
        </authorization>
    </system.web>
</location>

But I don't think this is the problem. Because if I don't use authentication I'm getting the same error.

Someone that knows the answer?

Answer 1

The problem is caused by the path /links you are trying to route is also a physical folder in your application root, in which case IIS would choose to use static file handler above getting routing handler involved. In that case, a request to /links is actually a list of content request to your /links folder, that is generally restricted by default and going to trigger the 403 you see. And I would assume even it's not denied, it won't be the behavior you are expecting.

A brute force way to get around this problem is to add this to your web.confg:

<system.webServer>
   <modules runAllManagedModulesForAllRequests="true" />
</system.webServer>

Which will force run all module on all path, that usually can cause some side effect, and surely will bring some level of performance impact site wide.

A more specific way to deal with this kind problem is to specify handler on specific path(s), in your case, you can try to add this in your web.config system.webServer -> handlers:

<handlers>
    <!--all other removes-->
    <add name="NameItProperly"
         path="/links"
         verb="GET,POST"
         type="System.Web.Handlers.TransferRequestHandler"
         preCondition="integratedMode,runtimeVersionv4.0" />
    <!--all other adds-->
</handlers>

Which will only force the route handler jump in for this specific path /links.