How do I allow all users access to one route within a website with integrated auth?

Question

I have an ASP.Net MVC app using Integrated Security that I need to be able grant open access to a specific route. The route in question is ~/Agreements/Upload. I have tried a few things and nothing has worked thus far.

<configuration> 
  <location path="~/Agreements/Upload">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>
</configuration> 

In IIS under Directory Security > Authentication Methods I only have "Integrated Windows Authentication" selected. Now, this could be part of my problem (as even though IIS allows the above IIS doesn't). But if that's the case how do I configure it so that Integrated Security works but allows people who aren't authenticated to access the given route?

Answer 1

In ASP.NET MVC you should not use the location element in the web.config. Whereas the web forms engine mapped to physical files on disk, the MVC engine using routing. This means that you could inadvertently allow access to a "protected controller" through a custom route by accident.

The recommended way of securing ASP.NET MVC applications is through the use of the Authorize attribute, as seen in the example below:

public class HomeController : Controller
{
    [Authorize]
    public ActionResult Index()
    { 
        return View();
    }
}

The controller action is what you want to protect and not the route. The ASP.NET MVC Security bod, Levi Broderick is rather vocal about this issue:

1. Excluding an action from authorization in ASP.NET MVC 2
2. Problem with Authorization with IIS and MVC.

Answer 2

You need to allow anonymous access in IIS as well, as otherwise only windows authenticated users will be able to access anywhere in your site. You should deny access by default to anonymous users.

<deny users="?"/>
<allow users="*"/>

In your <location> section, allow anonymous users.

<allow users="?"/>