ASP.NET Membership: CSS being blocked by Deny users, page doesn't render correctly?

Question

I have a page that functions correctly but when i issue a deny user for the whole site it redirects me to the logon page which seems to work BUT the css is not working. Henc

Answer 1

Try removing the tilda (~) in your location's path attribute. If you look at the fiddler result, its a callback request for your css. so the unauthenticated request for the page is in turn making unauthenticated requests for resources (the css).

I generally try to place a styles directory at the root of the application, and then use a helper tool like T4MVC or my own helper methods to translate and avoid having to figure out the ../../ directory crawling.

Answer 2

The 302 is from the login framework redirecting you to login when requesting the CSS.

The trick here is your MVC app should not be configuring the security via web.config but rather you should be using the [Authorize] attributes on your controllers which will not interfere with your CSS.

Answer 3

Use fiddler to see exactly what is happening to that resource? May shed light on the mystery. It should 403 if it is unauthorized. May be 404ing? If it's not in a virtual directory you could just write:

<link href="/Content/Site.css" rel="stylesheet" type="text/css" />

(directory traversing is flimsy)

Update - now more info

Nice fiddler use ;) Anyway, since it is 302ing (temporarily redirecting) your css files to require validation too the problem is your forms authentication.

You are probably running into the runAllManagedModuleForAllRequest="true" problem. Read that post for info.

Or set the all access to the Content folder to allow access. You're almost there but it would need to be:

<location path="Content">             
   <system.web>             
     <authorization>             
       <allow users="*" />             
     </authorization>             
   </system.web>             
 </location> 

Answer 4

i had a similar problem. if it helps, i added permission (IUSR or depending on your OS) to the root web directory, it worked.

Answer 5

You can simply allow app to access your css file :

<location path="Style.css">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>

Answer 6

For starters, avoid hardcoded paths to resources like JS or CSS files in your ASP.NET MVC views. Using /Content/Site.css does no better than ../../..

Use Url.Content helper:

<%=Url.Content("~/public/scripts/jquery-1.4.2.min.js")%>