title: web.config authorization deny unauthorised
body: <p>I am developing a .NET for ASP.NET Web Application and am trying to deny all users who are unauthorised from accessing my application but allowing them only to the login page. </p>
  
  <p>Below is a snippet of the code which is inside my system.web section:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
     &lt;forms loginUrl="Login.aspx" timeout="60" name="APPNAME" slidingExpiration="true" /&gt;
  &lt;/authentication&gt;
  &lt;authorization&gt;
     &lt;deny users="?" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>I also have this outside to allow access to the login page:</p>
  
  <pre><code>  &lt;location path="Login.aspx"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  </code></pre>
  
  <p>However I am still able to access pages when I am not logged in, how could I stop this from happening?</p>
  
  <p>I have even added a Web.Config file to the Main folder which stores most of the website files which the contents of is:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
      &lt;appSettings/&gt;
      &lt;connectionStrings/&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;deny users="?" /&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>But this is still not having any effect.</p>
  
  <p><strong>Solution</strong></p>
  
  <p>I had followed some optimisation tips for asp.net (<a href="http://www.codeproject.com/KB/aspnet/10ASPNetPerformance.aspx" rel="nofollow">http://www.codeproject.com/KB/aspnet/10ASPNetPerformance.aspx</a>) and removed the AnonymousIdentification httpModule which I actually needed.</p>