IIS Password prompt for given folder ASP.NET MVC

Question

How can I configure IIS to prompt for passwords on a web application running on ASP.NET MVC in IIS?

I want to password protect the Views\ApplicationLog\ folder, so that browsers ask for username and password when users try to access this folder.

How could I accomplish this? Can this be done directly from IIS, or do I need to set something in web.config?

Please try to be thorough, I don't know IIS all that well.

In production, we have IIS 6.0 – bevacqua Aug 08 '11 at 14:06 — bevacqua, Aug 08 '11 at 14:06

score 2 · Accepted Answer · answered Aug 08 '11 at 14:05

2

If you're using MVC, you shouldn't have anyone directly accessing anything under your Views folder at all. Instead, your Controllers (or their actions) will assert whatever authentication is required.

In this specific case, it looks like your controller is named ApplicationLogController. So you'd add an [Authorize] attribute on the controller as follows, and it will automatically ensure that anyone accessing the controller methods is authorized.

[Authorize] // You can also do [Authorize(Roles="MyRole,YourRole")], etc...
public class ApplicationLogController : Controller
{
...
}

answered Aug 08 '11 at 14:05

GalacticCowboy

11,663
2
41
66

I did this, but it doesn't prompt users for credentials, it just boots them. – bevacqua Aug 08 '11 at 19:05
DO you have authentication set up in your web app? I.e. with the login page URL, etc.? – GalacticCowboy Aug 08 '11 at 19:37
No. In fact I got it working in IIS 7.5, but in 6.0 it happily serves the page to everyone. Even when I've disabled everything from anonymous login to windows authentication. – bevacqua Aug 08 '11 at 19:51
If you're willing, could you post the relevant portions of web.config? (The `authentication` and `membership` elements) Also make sure you don't have impersonation turned on. – GalacticCowboy Aug 08 '11 at 20:29
None of those are even declared – bevacqua Aug 08 '11 at 20:53
That's probably why IIS6 isn't enforcing it, then - it's not configured to do so. – GalacticCowboy Aug 08 '11 at 21:00

score 0 · Answer 2 · answered Aug 08 '11 at 21:57

In the IIS 6 manager, go to the "Directory Security" tab, click on "Edit" then check "Integrated Windows Authentication" and / or "Basic Authentication" depending on the modes you want to support.

In system.web within your app's web.config:

<authentication mode="Windows">
<authorization>
  <deny users="?" />
</authorization>

IIS Password prompt for given folder ASP.NET MVC

2 Answers2

Linked