title: MVC, Browser return error: Website redirected you too many times When I browse a file on a specific restricted folder by web.config file
body: <p>I want restrict access of anonymous users to Music folder (in the root of my website). Then I put this code in <strong>web.config</strong> file <strong>in the <code>Music</code> folder</strong>:</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot;?&gt;
  &lt;configuration&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;           
              &lt;deny users=&quot;?&quot; /&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/configuration&gt;
  </code></pre>
  <p>I tested this one too:</p>
  <pre><code>&lt;allow users=&quot;*&quot; /&gt;
  &lt;deny users=&quot;?&quot; /&gt;
  </code></pre>
  <hr />
  <p>Also the <strong>web.config</strong> file of the website has the bellow config:</p>
  <pre><code>&lt;authentication mode=&quot;Forms&quot;&gt;
        &lt;forms loginUrl=&quot;~/account/login&quot; timeout=&quot;2880&quot; /&gt;
  &lt;/authentication&gt;
  
  &lt;modules runAllManagedModulesForAllRequests=&quot;false&quot;&gt;
        &lt;remove name=&quot;FormsAuthenticationModule&quot; /&gt;
        &lt;add name=&quot;FormsAuthenticationModule&quot; type=&quot;System.Web.Security.FormsAuthenticationModule&quot; /&gt;
        
        &lt;remove name=&quot;UrlAuthorization&quot; /&gt;
        &lt;add name=&quot;UrlAuthorization&quot; type=&quot;System.Web.Security.UrlAuthorizationModule&quot; /&gt;
  &lt;/modules&gt;
  
  &lt;rule name=&quot;Redirect to https&quot; enabled=&quot;true&quot; stopProcessing=&quot;true&quot;&gt;
        &lt;match url=&quot;.*&quot; /&gt;
        &lt;conditions&gt;
          &lt;add input=&quot;{HTTPS}&quot; pattern=&quot;off&quot; /&gt;
        &lt;/conditions&gt;
        &lt;action type=&quot;Redirect&quot; url=&quot;https://{HTTP_HOST}/{R:0}&quot; appendQueryString=&quot;false&quot; redirectType=&quot;Permanent&quot; /&gt;
  &lt;/rule&gt;
  
  &lt;location path=&quot;~/Music&quot;&gt;
      &lt;system.webServer&gt;
        &lt;handlers accessPolicy=&quot;Read&quot; /&gt;
      &lt;/system.webServer&gt;
  &lt;/location&gt;
  </code></pre>
  <hr />
  <p>And this code is part of the <strong>startup.cs</strong>:</p>
  <pre><code>var loginPath= new UrlHelper(HttpContext.Current.Request.RequestContext).Action(MVC.Account.Login());
  
  appBuilder.UseCookieAuthentication(new CookieAuthenticationOptions
  {
      AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
      LoginPath = new PathString(loginPath),
      // Other Codes
  }
  </code></pre>
  <p>Now, when i browse to <code>example.com/music/1.mp3</code> it return me to <code>/account/login</code> but when i login it show me the following error from the browser:</p>
  <blockquote>
  <p>WebsiteName redirected you too many times.</p>
  <p>net::ERR_TOO_MANY_REDIRECTS</p>
  </blockquote>
  <p><a href="https://i.stack.imgur.com/gZxz4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gZxz4.png" alt="enter image description here" /></a></p>
  <p>Also if i change the <strong>authentication mode</strong> to <code>none</code>, it show me a prompt like it (that i wont it!):
  <a href="https://i.stack.imgur.com/seLm7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/seLm7.png" alt="enter image description here" /></a></p>
  <blockquote>
  <p><strong>Note1:</strong> I cleared the browser cookies but no success.</p>
  </blockquote>
  <ul>
  <li><strong>What is the reason of the redirect loop?</strong></li>
  <li><strong>How should do this work as safe without redirect loop?</strong></li>
  </ul>
  <hr />
  <p><strong>Update:</strong></p>
  <p>My project has a <em>Return to Url</em> mechanism in the login page. So when i browse <code>/Music/1.mp3</code> it redirect me to <code>/account/login?ReturnUrl=/Music/1.mp3</code>and after login base this mechanism it redirect me to <code>/Music/1.mp3</code> automatically. I think in this step I have not enough access permission to open <code>/Music/1.mp3</code> again! And it redirect me to login page again and this loop continue until i get <code>ERR_T_OOMANY_REDIRECTS</code> error.</p>