Hello!
I have two applications that are nested. Let's call one Momma and the other Baby. Baby is nested inside Momma. Access to Momma is controlled with forms auth. The authorization section of the config file says this:
<deny users="?" />
That has worked well for Momma for the three years since I wrote her.
Baby is not set to use any special authentication. If I leave the authorization element out of his config, I get served login.aspx when I try to load him. When I enter valid credentials, the login.aspx page simply reloads. If I set him to deny unauthenticated
users like above, I also get the repeating login.aspx page. If I set his authorization to allow all and deny unauthenticated (<allow users="*" /><deny users="?" />), anybody can see him even if they are not authenticated by Momma. If I switch those so I'm
d ...
Go to the complete details ...