Disabling Forms Authentication for section of a site - asp.net

Question

I have an ASP.net MVC3 app running under IIS7 with forms auth enabled. There is also a co-hosted Nancy service hosted under a folder in the application.
The problem is that anytime a Nancy service returns a 401 (Unauthorized) status the request is automatically redirected to the login page.
is there a way to tell ASP.net to ignore 401 errors returning from that folder and just return the original json response?

Answer 1

I know this is old but I'll reply anyway.
It sounds like you have Forms Auth for the MVC website, and using Nancy as an API under say /nancy
To disable the authentication in that directory path you can add a location in your web.config, you most likely have one already to setup Nancy to run.
Something like:
<location path="nancy">
<system.web>
<compilation debug="true" targetFramework="4.0" />
<httpHandlers>
<add verb="*" type="Nancy.Hosting.Aspnet.NancyHttpRequestHandler" path="*"/>
</httpHandlers>
</system.web>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
<validation validateIntegratedModeConfiguration="false"/>
<handlers>
<add name="Nancy" verb="*" type="Nancy.Hosting.Aspnet.NancyHttpRequestHandler" path="*"/>
</handlers>
</system.webServer>
</location>
All you need to do in here is allow anonymous access, this can be done by adding authorization into system.web. Update the system.web like so:
<system.web>
<compilation debug="true" targetFramework="4.0" />
<httpHandlers>
<add verb="*" type="Nancy.Hosting.Aspnet.NancyHttpRequestHandler" path="*"/>
</httpHandlers>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
And this should ignore authentication for the folder now.

Answer 2

In the controller you can paint the Action (or entire Controller) with the AllowAnonymousAttribute
[AllowAnonymous]
public ActionResult DoSomething()
{
return View();
}