title: Web API anonymous service access with forms authentication
body: <p>I am trying to determine how to configure access to a Web API controller service under forms authentication. If I add authorization configuration to deny all anonymous users by adding the authorization element:</p>
  
  <p>&lt;authorization&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;!-- Deny all anonymous users --&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;deny users="?" /&gt;<br />
  &lt;/authorization&gt;</p>
  
  <p>Only the login page is accessible as expected. But I would also like access to a list returned from a controller. I added the [AllowAnonymous] attribute to a simple service that returns values used to populate a drop down menu. For example:</p>
  
  <pre><code>namespace WebAPI.Controllers
  {
      public class RegisterController : ApiController
      {
          [AllowAnonymous]
          public List&lt;ListElement&gt; GetActivitiesList()
          {
              List&lt;ListElement&gt; li = new List&lt;ListElement&gt;();
  
              li.Add(new ListElement() { Id = 1, Text = "Item 1" });
              li.Add(new ListElement() { Id = 2, Text = "Item 2" });
              li.Add(new ListElement() { Id = 3, Text = "Item 3" });
  
              return li;
  
          }
  
      }
  }
  </code></pre>
  
  <p>I added the controllers directory to the allowed list in the web.config:</p>
  
  <p>&lt;location path="Controllers"&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;system.web&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;authorization&gt;<br />
  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;allow users="*" /&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;/authorization&gt;<br />
  &nbsp;&nbsp;&nbsp;&lt;/system.web&gt;<br />
  &lt;/location&gt;<br /></p>
  
  <p>If I browse my sample page to invoke the controller, forms authentication still denies access with a 302 redirect to the login page, even if I add the [AllowAnonymous] attribute. If I remove the authorization element "&lt;deny users="?" /&gt;" for the entire site, I can control access using the [Authorize] and [AllowAnonymous] attributes.</p>
  
  <p>The objective is to be able to use specific services on a few pages (like registration) for anonymous users, while the rest of site access is restricted to authenticated users. Accessing a service is not exactly the same as accessing a file, so my guess is that I have to write a special handler for this situation, but I am not sure as to how to go about it.</p>