I have a website with restricted access. Only a number of IPs are allowed to access the site. I have configured the Access Restrictions for the web site so that only specified clients can access the app.
The problem is that all denied clients received a 403 http response status code with the following message:
Error 403 - This web app is stopped.
How could I change this behaviour, so that denid clients receive no response at all?
How about using "Dynamic IP Restrictions feature".
https://azure.microsoft.com/en-us/blog/confirming-dynamic-ip-address-restrictions-in-windows-azure-web-sites/
Example:
<system.webServer>
<security>
<ipSecurity allowUnlisted="false" denyAction="NotFound">
<add allowed="true" ipAddress="1.2.3.4"subnetMask="255.255.0.0"/>
</ipSecurity>
</security>
</system.webServer>
The allowable values for denyAction are:
AbortRequest (returns an HTTP status code of 0)
Unauthorized (returns an HTTP status code of 401)
Forbidden (returns an HTTP status code of 403).
Note this is the default setting.
NotFound (returns an HTTP status code of 404)
We are using a portal site for a bunch of our applications. We're using windows authentication to login to the portal. But if a user might be locked in AD they will get a 401 back from IIS.
In that scenario i want to redirect them instantly to my custom errorpage.
<httpErrors errorMode="Custom">
<remove statusCode="401" subStatusCode="-1" />
<error statusCode="401" prefixLanguageFilePath="" path="401Error.html" responseMode="File" />
</httpErrors>
I want to redirect them instantly without the windows authentication login prompt showing.
[1] https://i.imgur.com/goqk1RE.png
This is what i want to avoid, that page should show what so ever and just redirect to error page instantly. Only after you click cancel it gets redirected to the error page..
Ive tested alot of things in IIS and webconfig and im running out of ideas. Since this is only IIS, our code never gets reached.
I'm trying to stop MS Azure responding with the header/value of Server: HTTPAPI/2.0 on receipt of an invalid request, for example an invalid hostname.
I've seen this SO entry...
Removing Server and X-Powered-By HTTP Headers on Azure Web Site Preview
..and one answer suggests that the only way to get around this is to host the website on an Azure VM, something I'd much rather avoid.
It's 3.5 years on from that question/answer - does anyone know if it can now be suppressed in a WebApp solution
According the description at Remove standard server headers in Azure Web Sites:
HTTP headers are part of the communication process between web servers and browsers, and are included in the request and response. One example is the server header, which lists the product name and version of the web server (e.g., Microsoft-IIS/8.0). All web servers generate these headers, but now you can disable them on Azure Web Sites.
You can try to modify or create a new web.config in the root directory of your application on Azure Web Apps, with following content:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<security>
<requestFiltering removeServerHeader="true" />
</security>
</system.webServer>
</configuration>
Please refer to https://azure.microsoft.com/en-us/blog/removing-standard-server-headers-on-windows-azure-web-sites/ for more info.
To remove the MVC header, add this in Global.asax - Application Start event:
MvcHandler.DisableMvcResponseHeader = true;
Using this will remove the version headers,
<httpRuntime enableVersionHeader="false" />
I am trying to get started with using IIS. I created a new site on IIS Manager, mapped it to a folder on my file system and added index.html to the folder. I have set the port to 85 for this site. When I try to access http://localhost:85/index.html, I get the following error message:
401.3 - unathorized - You do not have permission to view this directory or page because of the access control list (ACL)
configuration or encryption settings for this resource on the Web
server.
I gave read access to everybody on the folder and tried again. I could then access the page.
I then compared the properties of my folder with that of wwwroot. I found that wwwroot had read access on IIS_IUSRS...When I did the same on my folder and tried again, I got the above error again.
I checkedthat anonymous access is enabled by default, but I still get this error.
Why does this happen? What is the correct way to resolve the problem?
I have struggled on this same issue for several days. It can be solved by modifying the security user access properties of the file system folder on which your site is mapped. But IIS_IUSRS is not the only account you must authorize.
In IIS management console, in the Authentication part of the configuration of your site, modify the "Anonymous authentication" line and check the account set as "Specific user" (mine is IUSR).
Give read and execution permission on the folder of your site to the account listed as the specific user.
OR
In IIS management console, in the Authentication part of the configuration of your site, modify the "Anonymous authentication" line by selecting "Identity of the application pool" instead of "Specific user".
Here is what worked for me.
Set the app pool identity to an account that can be assigned
permissions to a folder.
Ensure the source directory and all related files have been granted
read rights to the files to the account assigned to the app pool identity property
In IIS, at the server root node, set anonymous user to inherit from
app pool identity. (This was the part I struggled with)
To set the server anonymous to inherit from the app pool identity do the following..
Open IIS Manager (inetmgr)
In the left-hand pane select the root node (server host name)
In the middle pane open the 'Authentication' applet
Highlight 'Anonymous Authentication'
In the right-hand pane select 'Edit...' (a dialog box should open)
select 'Application pool identity'
TL;DR;
In most cases, granting access to the following account(s) (one|both) will be enough:
IIS AppPool\DefaultAppPool
IUSR
with Access Rights:
Read & Execute
List folder contents
Read
That's it!
Read on for a more detailed explanation...
Open IIS and select your application.
On the right side click on Authentication.
Select "Anonymous authentication"
here.
The following dialog pops up.
Grant access to the web application folder's ACL depending what is selected in the pic above:
Specific user: grant access for both IUSR (in my case) + IIS AppPool\DefaultAppPool
Application pool identity: grant access for IIS AppPool\DefaultAppPool only
IIS AppPool\DefaultAppPool account is the default AppPool account for new IIS web applications, if you have set a custom account, use the custom one.
Give the following permissions to the account(s):
Read & Execute
List folder contents
Read
Since you're dealing with static content...
On the folder that acts as the root of your website- if you right click > properties > security, does "Users" show up in the list? if not click "Add..." and type it in, be sure to click "Apply" when you're done.
Try this solution:
https://serverfault.com/questions/38222/iis-7-5-windows-7-http-error-401-3-unauthorized
Also check if the user running the IIS AppPool has read access to that folder/file.
Have a look at this:
http://www.iis.net/learn/manage/configuring-security/application-pool-identities
Also have a look at this:
http://www.iis.net/learn/get-started/planning-for-security/understanding-built-in-user-and-group-accounts-in-iis
Just in case anyone else runs into this. I troubleshooted all of these steps and it turns out because I unzipped some files from a MAC, Microsoft automatically without any notification Encrypted the files. After hours of trying to set folder permissions I went in and saw the file names were green which means the files were encrypted and IIS will throw the same error even if folder permissions are correct.
Create a new Site, Right Click on Sites folder then click add Site
Enter the site name.
Select physical path
Select Ip Address
Change Port
Click OK
Go to Application Pools
Select the site pool
Right-click the click Advance Settings
Change the .Net CLR Version to "No Manage Code"
Change the Identity to "ApplicationPoolIdentity"
Go to Site home page then click "Authentication"
Right-click to AnonymousAuthentication then click "Edit"
Select Application Pool Identity
Click ok
boom!
for routes add a web.config
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="React Routes" stopProcessing="true">
<match url=".*" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
<add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
<add input="{REQUEST_URI}" pattern="^/(api)" negate="true" />
</conditions>
<action type="Rewrite" url="/" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
Another problem that may arise relating to receiving an unauthorized is related to the providers used in the authentication setting from IIS.
In My case I was experience that problem If I set the Windows Authentication provider as "Negotiate". After I selected "NTLM" option the access was granted.
More Information on Authentication providers
https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/authentication/windowsauthentication/providers/
Please enable the following items in Windows 2012 R2
If you are working with Application Pool authentication (instead of IUSR), which you should, then this list of checks by Jean Sun is the very best I could find to deal with 401 errors in IIS:
Open IIS Manager, navigate to your website or application folder where the site is deployed to.
Open Advanced Settings (it's on the right hand Actions pane).
Note down the Application Pool name then close this window
Double click on the Authentication icon to open the authentication settings
Disable Windows Authentication
Right click on Anonymous Authentication and click Edit
Choose the Application pool identity radio button the click OK
Select the Application Pools node from IIS manager tree on left and select the Application Pool name you noted down in step 3
Right click and select Advanced Settings
Expand the Process Model settings and choose ApplicationPoolIdentityfrom the "Built-in account" drop down list then click OK.
Click OK again to save and dismiss the Application Pool advanced settings page
Open an Administrator command line (right click on the CMD icon and select "Run As Administrator". It'll be somewhere on your start menu, probably under Accessories.
Run the following command:
icacls <path_to_site> /grant "IIS APPPOOL\<app_pool_name>"(CI)(OI)(M)
For example:
icacls C:\inetpub\wwwroot\mysite\ /grant "IIS APPPOOL\DEFAULTAPPPOOL":(CI)(OI)(M)
Especially steps 5. & 6. are often overlooked and rarely mentioned on the web.
To optimize the images and automatically generate CSSprites use a microsoft package called Sprite Optimization and Image Preview 4
Error
Locally everything works perfectly, but to publish my site the following error occurs:
Access to the path 'D:\Hosting\8399780\html\dev\App_Sprites\blank.gif' is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Access to the path 'D:\Hosting\8399780\html\dev\App_Sprites\blank.gif' is denied.
ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
Attempt
In an attempt to resolve the problem within 'App_Sprites' folder, added the following web.config:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
<system.webServer>
<security>
<authorization>
<add accessType="Allow" users="*" />
</authorization>
</security>
</system.webServer>
</configuration>
'blank.gif' image is not used anywhere in my application!
Inside the App_Sprites folder there are a only one subfolder called hire;
I believe that this framework is trying to write a blank.gif file to that directory. You need to give the account under which the IIS app pool runs write access to that folder in windows.