title: ASP.NET web.config authorization settings ignored
body: <p>I was searching for some solution but can't find one.  There is <a href="https://stackoverflow.com/questions/1306856/authorization-settings-for-a-folder-in-asp-net">this</a> and <a href="https://stackoverflow.com/questions/691533/asp-net-web-config-authorization-settings-ignored">this</a> ones but can't found and answer there. Im developing an asp.net application on <strong>ASP.NET development server</strong>.  I have the following web.config in my root asp.net folder:  </p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;  
  &lt;configuration&gt;  
    &lt;system.web&gt;  
      &lt;compilation debug="true" targetFramework="4.0" /&gt;  
      &lt;authentication mode="Forms"&gt;  
        &lt;forms name="4df5d465h"  
            loginUrl="~/login.aspx"  
            protection="All"  
            timeout="30" path="/" /&gt;  
      &lt;/authentication&gt;  
      &lt;authorization&gt;  
        &lt;deny users="?"/&gt;  
      &lt;/authorization&gt;  
    &lt;/system.web&gt;  
  &lt;/configuration&gt;  
  </code></pre>
  
  <p>My image folder is together my main web.config at root asp.net application folder.<br>
  <strong><em>Inside the image folder</em></strong> I put the following web.config:  </p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;  
  &lt;configuration&gt;  
    &lt;system.web&gt;  
      &lt;authorization&gt;  
        &lt;allow roles="*"/&gt;  
        &lt;allow users="*"/&gt;  
      &lt;/authorization&gt;  
    &lt;/system.web&gt;  
  &lt;/configuration&gt;  
  </code></pre>
  
  <p>I put role attribute after to see if its work.<br>
  I wrote the main web.config in this way too:  </p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;  
  &lt;configuration&gt;
    &lt;system.web&gt;  
      &lt;compilation debug="true" targetFramework="4.0" /&gt;  
      &lt;authentication mode="Forms"&gt;  
        &lt;forms name="3D45C7D8B0B0C"  
            loginUrl="~/login.aspx"  
            protection="All"  
            timeout="30" path="/" /&gt;  
      &lt;/authentication&gt;  
      &lt;authorization&gt;  
        &lt;deny users="?"/&gt;  
      &lt;/authorization&gt;  
    &lt;/system.web&gt;  
  
    &lt;location path="~/image"&gt;  
      &lt;system.web&gt;  
        &lt;authorization&gt;  
          &lt;allow users="*"/&gt;  
        &lt;/authorization&gt;  
      &lt;/system.web&gt;  
    &lt;/location&gt;  
  &lt;/configuration&gt;
  </code></pre>
  
  <p><strong>But the login page never can load the images</strong>  </p>
  
  <p>In design mode, inside visual studio editor, the image load in login.aspx page then image tag must be ok.  </p>
  
  <p>What I'm doing wrong??  Thanks a lot.</p>
  
  <p>@nico, thanks a lot for format my question. No im not rewriting nothing. Its most simple and default asp.net application possible. Its default template asp.net application with an link on Default.aspx and a simple login.aspx page, its a test project, the login form works but the image doesn't load.</p>
  
  <p>@Chris_Lively, yes there is a web.config in image folder, its web.config with &lt;'allow roles='*'>, i checked, the folder is named image\ , the src of image tag point to image\ its getting me crazy</p>