Basic authentication in asp.net avoided if runAllManagedModulesForAllRequests="True"

Question

We have one module which does internal redirection to real aspx pages. He is also in charge for directly serving cached/compressed HTML/txt/cs/js output to client.

Here is how web.config looks like for modules section:

<modules runAllManagedModulesForAllRequests="True">      
  <remove name="RequestInterceptor" />
  <add type="Lib.Request.RequestInterceptor" name="RequestInterceptor" />
  <remove name="Session" />
  <add type="System.Web.SessionState.SessionStateModule" name="Session" />
</modules> 

Basic authentication is turned on on IIS7. When first visitor comes to site login popup shows and he is correctly authenticated, and then pages which he visits get cached. When next visitor comes authentication pop up doesn't show up, unless he visits a page which was not visited by previous visitor (page that is not cached). Once the cache has expired, authentication works again until the page content gets cached, and so on.

Is there a way to force authentication for every visitor? Maybe we need to add basic authentication module to module section of web.config (how to do that)?

Thanks in advance. Cheers

Answer 1

Because httpmodule intercepts each request, server is not able to map appropriate handler for static files, dynamic files, and among others secuirty authentication.