Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   ASP .Net Security (http://www.velocityreviews.com/forums/f62-asp-net-security.html)
-   -   IIS 6 and ASP.NET security (http://www.velocityreviews.com/forums/t767768-iis-6-and-asp-net-security.html)

Michael Tsai 08-18-2005 08:50 AM

IIS 6 and ASP.NET security
 
Hi,
It said that IIS 6 use HTTP.sys as the front end for
handling HTTP request, and pass ASP.NET requests
to w3wp.exe. So I think this also means security
settings in IIS (metabase) is bypassed, right?

Apparently the answer is no, I'ved tried using IIS to set my
ASP.NET web application's authentication method to basic
authentication, but my web app's web config still allow
anonymous access. When I use browser to acces my Web
app, it asks me to input username and password. So IIS
metabase is still used, but how? All the information I found
with Google just show that HTTP.sys directly pass request
to w3wp.exe, so when/where did IIS metabase be read and
applied?

Thanks!

Michael Tsai



Dominick Baier [DevelopMentor] 08-19-2005 06:40 AM

Re: IIS 6 and ASP.NET security
 
Hello Michael,

W3svc reads the metabase on statup (or when changed) and registers all the
information with http.sys.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> Hi,
> It said that IIS 6 use HTTP.sys as the front end for
> handling HTTP request, and pass ASP.NET requests
> to w3wp.exe. So I think this also means security
> settings in IIS (metabase) is bypassed, right?
> Apparently the answer is no, I'ved tried using IIS to set my
> ASP.NET web application's authentication method to basic
> authentication, but my web app's web config still allow
> anonymous access. When I use browser to acces my Web
> app, it asks me to input username and password. So IIS
> metabase is still used, but how? All the information I found
> with Google just show that HTTP.sys directly pass request
> to w3wp.exe, so when/where did IIS metabase be read and
> applied?
> Thanks!
>
> Michael Tsai
>






All times are GMT. The time now is 12:00 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.