title: Turning off ASP.Net WebForms authentication for one sub-directory
body: <p>I have a large enterprise application containing both WebForms and MVC pages. It has existing authentication and authorisation settings that I don't want to change.</p>
  
  <p>The WebForms authentication is configured in the web.config:</p>
  
  <pre><code> &lt;authentication mode="Forms"&gt;
    &lt;forms blah... blah... blah /&gt;
   &lt;/authentication&gt;
  
   &lt;authorization&gt;
    &lt;deny users="?" /&gt;
   &lt;/authorization&gt;
  </code></pre>
  
  <p>Fairly standard so far. I have a REST service that is part of this big application and I want to use HTTP authentication instead for this one service.</p>
  
  <p>So, when a user attempts to get JSON data from the REST service it returns an HTTP 401 status and a <code>WWW-Authenticate</code> header. If they respond with a correctly formed HTTP <code>Authorization</code> response it lets them in.</p>
  
  <p>The problem is that WebForms overrides this at a low level - if you return 401 (Unauthorised) it overrides that with a 302 (redirection to login page). That's fine in the browser but useless for a REST service.</p>
  
  <p>I want to turn off the authentication setting in the web.config, overriding the 'rest' folder:</p>
  
  <pre><code> &lt;location path="rest"&gt;
    &lt;system.web&gt;
     &lt;authentication mode="None" /&gt;
     &lt;authorization&gt;&lt;allow users="?" /&gt;&lt;/authorization&gt;
    &lt;/system.web&gt;
   &lt;/location&gt;
  </code></pre>
  
  <p>The <em>authorisation</em> bit works fine, but the <em>authentication</em> line (<code>&lt;authentication mode="None" /&gt;</code>) causes an exception:</p>
  
  <blockquote>
    <p>It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. </p>
  </blockquote>
  
  <p>I'm configuring this at application level though - it's in the root web.config - and that error is for web.configs in sub-directories.</p>
  
  <p>How do I override the <em>authentication</em> so that all of the rest of the site uses WebForms authentication and this one directory uses none?</p>
  
  <p>This is similar to another question: <a href="https://stackoverflow.com/questions/123726">401 response code for json requests with ASP.NET MVC</a>, but I'm not looking for the same solution - I don't want to just remove the WebForms authentication and add new custom code globally, there's far to much risk and work involved. I want to change just the one directory in configuration.</p>
  
  <p><strong>Update</strong></p>
  
  <p>I want to set up a single web application and in that I want all the WebForms pages and MVC views to use WebForms authentication. I want one directory to use basic HTTP authentication.</p>
  
  <p>Note that I'm talking about authentication, not authorisation. I want REST calls to come with the username &amp; password in an HTTP header, and I want WebForm &amp; MVC pages to come with the authentication cookie from .Net - in either case authorisation is done against our DB.</p>
  
  <p>I don't want to rewrite WebForms authentication and roll my own cookies - it seems ridiculous that is the only way to add an HTTP authorised REST service to an application.</p>
  
  <p>I can't add an additional application or virtual directory - it's got to be as one application.</p>