Making a public page accessible when Forms Authentication is used

Question

We have a website that is protected with Forms Authentication in IIS. We would like to make one page in this website accessible to everyone without any authentication.

All the resources I saw mentions using tag but it's not working for us for some reason.

web.config:

<configuration>
  <location path="public.htm">  
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

  <system.web>
    <authentication mode="Forms" >
      <forms loginUrl="UserLogin.aspx" />
    </authentication>
    <authorization>
      <deny users="*" />
    </authorization>
  </system.web>
</configuration>

Both public.htm and UserLogin.aspx are in the same folder. When we browse public.htm, we get 401.2.

If disable Forms Authentication, public.htm is accessible.

---

UPDATE (5/21):

Disabled Forms Authentication in but still getting 401.2 error.

<configuration>
  <location path="public.htm">  
    <system.web>
      <authentication mode="None" />
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>

  <system.web>
    <authentication mode="Forms" >
      <forms loginUrl="UserLogin.aspx" />
    </authentication>
    <authorization>
      <deny users="*" />
    </authorization>
  </system.web>
</configuration>

Answer 1

It sounds just like your anonymous authentication has been disabled or your current login user don't have permission to view the public.htm.

If you are hosting it in VS, please ensusre Enabled anonymous authentication has been selected and you current logon user have permission to access the htm file.

If you are hosting it in IIS, please ensure anonymous authentication has been enabled and the authorization rule would looks just like

<authorization>
      <deny users ="?" />
      <allow users = "*" />
    </authorization>

The authentication in applicationhost.config would looks like

  <location path="Sitename">
        <system.webServer>
            <security>
                <authentication>
                    <anonymousAuthentication enabled="true" />                    
                </authentication>
            </security>
        </system.webServer>
    </location>

And the authorization rule for public.htm would be.

<location path="public.htm">  
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>

Please remember to grant IUSER read permission to access public.htm.