title: How to deny anonymous users to virtual directory
body: <p>How can I deny access to my virtual directory, to those who havent logged into my asp.net website yet?</p>
  
  <p>I've hooked my website up to a virtual directory setup on my server (using IIS 7).  The VD contains pdf files, that I want only logged in users to be able to access.  My problem however, is I can't seem to "deny" anonymous users from accessing the files either.  Currently, if I type the direct path to a pdf file within my virtual directory, I can access it, even if I'm not logged into my site.</p>
  
  <p>I have a web.config file setup in the root of my virtual directory, which looks like this:</p>
  
  <pre><code> &lt;?xml version="1.0"?&gt;
   &lt;configuration&gt;
     &lt;system.web&gt;
       &lt;authentication mode="Forms"&gt;
          &lt;forms loginUrl="Login.aspx" /&gt;
       &lt;/authentication&gt;
       &lt;authorization&gt;
          &lt;deny users="?" /&gt;
       &lt;/authorization&gt;
     &lt;/system.web&gt;
   &lt;/configuration&gt;
  </code></pre>
  
  <p>Any idea how to fix this?</p>
  
  <p>Thanks</p>