---
title: "ASP.NET Authentication Question + Answer"
url: "https://osherove.com/blog/2003/4/28/aspnet-authentication-question-answer.md"
canonical: "https://osherove.com/blog/2003/4/28/aspnet-authentication-question-answer.html"
published: "2003-04-28T11:41:00"
updated: "2003-04-28T11:41:00"
tags: [".Net Original"]
author: "Roy Osherove"
description: "I can't seem to find an answer to this: Is it possible to use the tag in web.config to allow some of the pages in your site to be non-secure, meaning users can browse them without being redirected to the login page?…"
usage: "Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page)."
license: "https://creativecommons.org/licenses/by/4.0/"
---

# ASP.NET Authentication Question + Answer

By Roy Osherove April 28, 2003 In [.Net Original](https://osherove.com/blog/category/net-original)

**Historical article** · Originally published April 28, 2003; technical details may be outdated.

I can't seem to find an answer to this:

Is it possible to use the tag in web.config to allow some of the pages in your site to be non-secure, meaning users can browse them without being redirected to the login page?

Update:

Well, It didn't take very long for the answers to arrive! Thanks to [Fabrice](http://dotnetweblogs.com/fmarguerie/posts/6123.aspx) And [hElp Blog](http://dotnetweblogs.com/pleloup/posts/6121.aspx) For providing me with ways to achieve this :) Here are the replies:

**Fabrice:**

Sure, after protecting your pages with the following configuration: 

<

authentication mode="Forms">
<forms
    name=".ASPMyApp"
    loginUrl="Security/Login.aspx"
    protection="All"
    timeout="25" />
authentication> <authorization>
  <deny users="?" />
authorization>

you can authorize access to the Errors folder (for example) by adding this to the same web.config file.

<location pah="Errors">
  <system.web>
    <auhorization>
      <allow users="\*" />
    auhorization>
  system.web>
location>

You could also do the same by adding a web.config file in the Errors folder, which content would be:

xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.web>
    <

auhorization>
      <allow users="\*" />
    auhorization>
  system.web>
configuration>

[**hElp Blog**](http://dotnetweblogs.com/pleloup/posts/6121.aspx)

Roy what I do myself is to put everything to be secure in a folder, duplicate the web config in this folder and modify the tags.

The main web config of your application has to allow everybody.

It works for me !

## More in .Net Original

[All posts in .Net Original](https://osherove.com/blog/category/net-original)

- Apr 30, 2003

    ### [A VS.NET 2003 Registry Tweaker Don Could Use](https://osherove.com/blog/2003/4/30/a-vsnet-2003-registry-tweaker-don-could-use.html)

- Apr 30, 2003

    ### [Advanced Dataset Helper Classes](https://osherove.com/blog/2003/4/30/advanced-dataset-helper-classes.html)

- Apr 27, 2003

    ### [More Debugger Problems: aspnet\_regiis does not work on Windows 2003 Server](https://osherove.com/blog/2003/4/27/more-debugger-problems-aspnet_regiis-does-not-work-on-window.html)

- Apr 27, 2003

    ### [Regular Expressions And Log Parsing](https://osherove.com/blog/2003/4/27/regular-expressions-and-log-parsing.html)


---

## About the author

**Roy Osherove**: Senior Solutions Architect at AWS working on AI for production and AI-driven development; author of The Art of Unit Testing and Elastic Leadership, with about 20 years of consulting and training on unit testing, TDD, team leadership and continuous delivery.

### Sites

- [RobotPaper](https://robotpaper.ai/): This blog: AI patterns and anti-patterns, AI and coding agents, and engineering leadership.
- [osherove.com](https://osherove.com): Roy's personal site. Author of The Art of Unit Testing and Elastic Leadership; consulting and training on unit testing, TDD, team leadership and continuous delivery, plus about 20 years of blog posts.
- [The Art of Unit Testing](https://www.artofunittesting.com): The Art of Unit Testing, 3rd Edition (Manning): readable, maintainable, trustworthy unit tests, plus TDD workshops in C#, JavaScript, Java and Kotlin.
- [5whys.com](https://www.5whys.com): Roy's writing on software team leadership: self-organizing teams, surviving chaos, learning mode and the Elastic Leadership model.
- [Pipeline Driven](https://pipelinedriven.org): Continuous delivery and DevOps practices: build patterns, pipeline-friendly testing, DevOps metrics and enterprise DevOps.
- [Elastic Leadership](https://www.elasticleadership.com): Elastic Leadership, Roy's framework for software team leaders (survival, learning and self-organizing modes).

### Social

- X: https://x.com/royosherove
- LinkedIn: https://www.linkedin.com/in/osherove/

### Contact

- Contact form: https://forms.gle/jQSx5KoXvrVA1JCK7

### License

Licensed under CC BY 4.0 — reuse, quote and adapt with attribution (Roy Osherove, link to the original page). License: https://creativecommons.org/licenses/by/4.0/