Directory Listing Denied IIS 6

Hi All,
I've been trying to lunch an asp.net application for days now with no joy.
I keep getting 'Directory Listing Denied This Virtual Directory does not allow contents to be listed.'(on firefox) or 'You are not authorized to view this page' (on IE). I'm using IIS 6 on windows server 2003. I've had no problem running this application on windows 7 or server 2008. Any ideas on to make it work?

Thanks.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

sting_224

I've applied every NTFS permission I know of and that which I got while searching the internet but still no joy. I really need help on this one guys.

Bl8ckr0uter

I seem to recall a checkbox in the IIS manager that allow directory listing. I think it was on the tab where the permissions are (and where you set the app pool).

sting_224

I can only see 'Directory Browsing' checkbox located on the Home Directory Tab of the application website when i check its properties. I don't know if that's the one u mean but i checked it. it browses the files i uploaded but not the application.

Bl8ckr0uter

That should allow you to browse the entire directory path of that app (bin folder and etc). What do you mean its not letting your browse the directory? Also is this windows authenticated? I had issues with using FF and windows authentication on certain apps in IIS6.

RobertKaucher

sting_224 wrote: »

Hi All,
I've been trying to lunch an asp.net application for days now with no joy.
I keep getting 'Directory Listing Denied This Virtual Directory does not allow contents to be listed.'(on firefox) or 'You are not authorized to view this page' (on IE). I'm using IIS 6 on windows server 2003. I've had no problem running this application on windows 7 or server 2008. Any ideas on to make it work?

Thanks.

What is the name of your primary page in the app? It needs to be default.aspx for an ASP.NET application. If it is not when you go to http://myap/ and IIS looks for the default page it does not find it an assumes you want a list of the directory. Since that is not allowed by default, and I would argue should not be enabled without good reason, it throws an error.

sting_224

What I expect is that when for example i type IANA — Example domains in my browser, i get redirected to the login page IANA — Example domains. With the directory browsing checked, all i see is the website files like Admin.aspx, Analyser.aspx, login.aspx like i'm browsing an ftp site.

sting_224

RobertKaucher wrote: »

What is the name of your primary page in the app? It needs to be default.aspx for an ASP.NET application. If it is not when you go to http://myap/ and IIS looks for the default page it does not find it an assumes you want a list of the directory. Since that is not allowed by default, and I would argue should not be enabled without good reason, it throws an error.

Before my post I added default.aspx manually and moved it up but still got this error. I was wondering if I had to do it manually or if it is done automatically.

RobertKaucher

sting_224 wrote: »

What I expect is that when for example i type IANA — Example domains in my browser, i get redirected to the login page IANA — Example domains. With the directory browsing checked, all i see is the website files like Admin.aspx, Analyser.aspx, login.aspx like i'm browsing an ftp site.

The login redirect is usually done programmatically in IIS 6 via code such as:

if (User.Identity.IsAuthenticated == false)
{
     Response.Redirect("URL_to_RESOURCE");
}

The main page, usually called default.aspx, must be present as I stated in my previous post. If you do not have a default main page configured you will just get a directory list. You should TURN OFF directory listing, btw. Ensure whatever page you expect to be the main page people view after logging in is configured as the default page in IIS. IIS 7 supports login redirection-based authentication, IIS 6 does not.

RobertKaucher

sting_224 wrote: »

Before my post I added default.aspx manually and moved it up but still got this error. I was wondering if I had to do it manually or if it is done automatically.

What do you mean you added it manually? Added it to what? The root directory or in the VisualStudio project? What is the authentication scheme being used in IIS?

sting_224

RobertKaucher wrote: »
The login redirect is done programmatically via
if (User.Identity.IsAuthenticated == false)
{
     Response.Redirect();
}
The main page, usually called default.aspx, must be present as I stated in my previous post. If you do not have a default main page configured you will just get a directory list. You should TURN OFF directory listing, btw. Ensure whatever page you expect to be the main page people view after logging in is configured as the default page in IIS.

Redirect works when I run the website on win7 or win server 2008 IIS7 so I guess redirect has been sorted out. Now I'm trying to run it on server 2003 iis6. I added the default.aspx in iis under the Documents tab of the properties of the website.

RobertKaucher

sting_224 wrote: »

Redirect works when I run the website on win7 or win server 2008 IIS7 so I guess redirect has been sorted out. Now I'm trying to run it on server 2003 iis6. I added the default.aspx in iis under the Documents tab of the properties of the website.

Yeah, you're right. That's what I was getting at. You'll need to add a programatic redirect to default.aspx or stick with IIS 7+.

Configuring Authentication in IIS 7

sting_224

RobertKaucher wrote: »

Yeah, you're right. That's what I was getting at. You'll need to add a programatic redirect to default.aspx or stick with IIS 7+.

Configuring Authentication in IIS 7

oh sorry, now I think I get you.

RobertKaucher

sting_224 wrote: »

oh sorry, now I think I get you.

I was not very clear. I have edited my post to add clarity. Sorry.