How does ASP.NET security relate to IIS security?
This is one of the main “problems” people are faced with when they are building secure web applications today. The question however is pretty simple. IIS security comes before ASP.NET security. So, if IIS does not allow the user to get in to the system, ASP.NET won’t be called in any way and thus the security of ASP.NET does never get a chance to do its job since the request has been denied already (or authentication on the level of IIS is required first). To solve this kind of problems, always think of the workflow an HTTP request goes through when it comes in to IIS and is meant to be handled by ASP.NET (e.g. since it has an .
