title: ASP.NET auth, exclude root & allow anonymous
body: <p>We have a weird issue found during setting up a new Windows 2003 Server with IIS6.0 &amp; ASP.NET 2.0, our site is built using ASP.NET forms authentication with general authorization to deny access to all users &amp; allow explicitly to static, home pages etc, -- web.config setting for forms auth looking as below:</p>
  
  <pre><code>     &lt;authentication mode="Forms"&gt;
          &lt;forms name="appNameAuth" path="/" loginUrl="~/Pages/Users/Login.aspx" protection="All" timeout="60" defaultUrl="~/Pages/Inner.aspx"&gt;
          &lt;/forms&gt;
      &lt;/authentication&gt;
      &lt;authorization&gt;
          &lt;deny users="?"/&gt;
      &lt;/authorization&gt;
  </code></pre>
  
  <p>Issue is this:</p>
  
  <p>If we access the site as localhost/default.aspx works fine &amp; can view the home page of our website, but if we access using localhost/ - expect to view the default.aspx (as it's set as default document), but for some reason ASP.NET Forms Authentication thinks "/" is a protected page or content &amp; redirects me to login page.</p>
  
  <p>I couldn't find anyway to inform "/" as allow = *, in web.config... thought it might be linked with some NTFS &amp; IIS permission issue with folders, could not get much update about..</p>
  
  <p>Any help to resolve this, would be appreciated.</p>
  
  <p>Thanks</p>
  
  <p>Bhaskara </p>