CODEWITHSUNDEEP
asp.net
goroth
goroth

Reputation: 2610

HTTP Error 404.15 The request filtering module is configured to deny a request where the query string is too long

I have created a brand new web form application from Visual Studio 2013 and set the following in the web.config file: 

<authentication mode="Forms">
    <forms defaultUrl="~/Home.aspx" loginUrl="~/Login.aspx" 
        slidingExpiration="true" timeout="2880" />
</authentication>
<authorization>
  <deny users="?" />
</authorization>

When I run the project I get 404.15 error.
This is not an MVC site.
I found a similar error that said I need to remove the "deny users" but I don't want to do that.
I need all users to be directed to the login page if they have not authenticated.
* New Asp.Net MVC5 project produces an infinite loop to login page *
I also tried this but I get "This webpage has a redirect loop"
* How to configure the web.config to allow requests of any length *

EDIT: Added more links to explain the problem.
So I found and article about login page loops.
* http://erlend.oftedal.no/blog/?blogid=55 *
So if I add a break point on the ProcessRequest I can see that there is an infinite loop calling the Login.aspx page.
So the problem does not seem to be that the URL is too long but more likely that there is an infinite loop calling the Login.aspx page.
If I place a breakpoint on the Page_Load in side the Login.aspx page, the breakpoint never gets hit.
There must be something higher up causing the redirect.

Upvotes: 5

Views: 16025

Answers (2)

goroth
goroth

Reputation: 2610

Here is how I got it to work.

  1. Excluded all the items under the Account folder except Login.aspx
  2. Excluded IdentityConfig and Startup.Auth under the App_Start folder
  3. Excluded IdentityModels under the Models folder
  4. Excluded Startup under the root folder of the application
  5. Commented out all the code under Page_Load and LogIn inside the Login.aspx code file
  6. Commented out code with OpenAuthProviders in the Login.aspx markup
  7. Added the following key to the appSettings section inside the web.config file
<add key="owin:AutomaticAppStartup" value="false" />

Upvotes: 5

Sergio
Sergio

Reputation: 1423

The solution it's not completely deactivating the whole authentication system.

The problem may be caused by the access control not correctly setting Login.aspx permission when using the FriendlyUrls module. So you must force the permissions also for the Login page by it's "friendly" name. In the folder where login page it's stored, possibly will already be a web.config file that you may setup like this:

<?xml version="1.0"?>
<configuration>
  ...

  <location path="Login">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>
  <location path="Login.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>
  ...

</configuration>

Note: Take care with other pages currently in the same folder and setup accesses accordingly.

Upvotes: 4

Related Questions