How to Secure HTML files with Forms Authentication in ASP.NET 2.0

It all started out with an application built by someone in marketing.  She came to me and asked if it could be secured with a password.  I thought this would be an easy task, but forgot about the simple fact that IIS wouldn’t pass the HTML files through the ISAPI dll.

So here we go.  If you want to secure HTML documents you need to go through a number of steps.

1. You need to tell IIS how to handle the HTML file.  In this case we want to run the HTML file through aspnet_isapi.dll.
   1. Click on the Directory tab in your ASP.NET application in IIS
   2. Find the .aspx extension, open it, and copy the executable path
   3. Cancel out of .aspx extension and click the Add button
   4. Paste the executable path into this new extension window
   5. For extension, type in .html or .htm depending on what you are using
   6. Click on Limit to: and type in GET,HEAD,POST,DEBUG
   7. Make sure Script engine is checked and that Verify that file exists is NOT
   8. Now html documents will be mapped through the .NET ISAPI
2. This is where it all gets interesting.  I had done everything in IIS, but HTML files were not being rendered (it was a blank page).  Here’s what I did to alleviate that.
   1. In the web.config add

      <httpHandlers>
        <add path="*.html" verb="GET,HEAD,POST,DEBUG" 
      type="System.Web.UI.PageHandlerFactory" validate="true" />
      </httpHandlers>

   2. And…

      <compilation>
            <buildProviders>
              <add extension=".html" type="System.Web.Compilation.PageBuildProvider" />
            </buildProviders>
      </compilation>

3. This is what fixed my issue, and everything is now behaving as expected. How did you resolve it?

Helpful Resource: HOW TO: Migrate an ASP Web Application to ASP.NET While Retaining Existing File Name Extensions