title: ASP.NET 2.0 and 4.0 seem to treat the root url differently in Forms Authentication
body: <p>If have the following <code>web.config</code>:</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;system.web&gt;
      &lt;authentication mode="Forms"&gt;
        &lt;forms name="MembershipCookie" 
               loginUrl="Login.aspx" 
               protection="All" 
               timeout="525600" 
               slidingExpiration="true" 
               enableCrossAppRedirects="true" 
               path="/" /&gt;
      &lt;/authentication&gt;
      &lt;authorization&gt;
        &lt;deny users="?"  /&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;location path="Default.aspx"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>The application is an ASP.NET 2.0 application running on Windows 2008R2/IIS7.5.</p>
  
  <p>If the site's application pool is configured to run ASP.NET 2.0 and I browse to <code>http://example.com</code> then <code>Default.aspx</code> is rendered as you'd expect from the rules above.</p>
  
  <p>However if the application pool is set to run ASP.NET 4.0 I am redirected to the login page. If I explicitly specify <code>http://example.com/default.aspx</code> then all is good and <code>default.aspx</code> renders.</p>
  
  <p>I've tried rewriting <code>/ -&gt; /default.aspx</code> (using IIS UrlRewriter 2.0) but the result is still the same, I get kicked to the login page.</p>
  
  <p>I've also tried this with an ASP.NET 4.0 application with the same result (which is where the problem initially arose). The reason I tried this with a 2.0 application was to see if there was a change in behaviour, and it seems that <code>/</code> <em>is</em> handled differently in 4.0.</p>
  
  <p>So to summarise, using the configuration above the following is observed:</p>
  
  <pre>
  ASP.NET Version  Url                                 Behaviour
  -------------------------------------------------------------------------
  2.0              http://example.com                  Renders Default.aspx
  2.0              http://example.com/Default.aspx     Renders Default.aspx
  4.0              http://example.com                  Redirects to Login.aspx
  4.0              http://example.com/Default.aspx     Renders Default.aspx
  </pre>
  
  <p>Is this a bug/breaking change or have I missed something glaringly obvious?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I have got to the bottom of this issue, see my own answer below.</p>