IIS 8.5 is not serving JS, CSS, and Image files (static content)

Question

The problem

We're running IIS on Windows 8.1 with Update. We're at the Orchard CMS first time setup screen, and IIS is giving 401s for all static content. We have read the following to no avail:

• IIS 7.5 no images css js showing
• IIS 7.5 no images css js showing
• The official Orchard deployment documentation

Based on those, this is what I have tried that doesn't work.

1. Turn on the IIS feature to Serve Static Content.
2. Give IIS_IUSRS permission to Read, write & execute.
3. Give the site's application pool permission to Read, write & execute.

What does work though is the nuclear option: to give Everyone the Read permission (unless we want to proceed with the Orchard setup; then we need to give Everyone even more permissions.) That leads me to believe that I must give permission to some principle with less scope than Everyone but more scope than both IIS_IUSRS and the application pool combined.

Who/what is that principle?

Pictures to show the problem

We receive a 401 on ..\Themes\SafeMode\Styles\site.css

The task manager confirms that the site is running as the orchard user.

The security properties of the ..\Themes\SafeMode\Styles\ directory gives Read permission to orchard.

Why does it only work when we give Read permission to Everyone?

Sophister

using NetworkService as the application pool's login might work for you (and set RW perms for that on the folder) – Meld

That didn't work. I set the orchard application pool's identity to NetworkService, gave Network Service RW permission on the folder, recycled the app pool, and restarted the website. I still get the same 401. – Sophister

could you plz show authentication section from web.config and show us how is authentication configured in iis? – Thornie

@PankajKapare There doesn't seem to be anything in the system.webServer section of the main web.config to cause a 401. Further, the system.web > authentication is just standard Forms auth and won't have anything to do with it. – Sophister

@PankajKapare For the specific site, IIS has both Anonymous Authentication and Forms Authentication enabled and has ASP.NET Impersonation disabled. – Sophister

Answer 1

I had a similar problem. Under authentication, I right clicked "Anonymous Authentication" and clicked "Edit". That shows a dialog giving you the ability to set the identity of the anonymous user. I set it to "Application pool identity" and that fixed the problem for me.

.

This may not be the most secure configuration though, but I'm on a dev server so I don't care.

Sidedress

Answer 2

Try turn on the Static Content and Directory Browsing features under Internet Information Services->World Wide Web Services->Common HTTP Features node.

Rubstone

this was my solution, but try to install "directory Browsing" as well. happy coding :) – Orchardman

Answer 3

In my case I had to set Read permission for IUSR user for the web site folder.

Ombre

Answer 4

So, what I had to do to fix this problem was the following: (and please understand, that this is not ASP or PHP script related, the server wouldn't even show basic simple .html files, yet would serve out PHP results all day long!)

Two fold…

1. Had to set the application pool for each site, under advanced settings, to use LocalSystem for it’s process
2. Under site, advanced settings, security, add the IUSR account to have read & list contents access, for the site… :-)

See any problems with doing that?

'cuz it's working....

Argile

Answer 5

Updating windows feature for WWW services/Common Http Features/static content by selecting Static Content checkbox fixed my IIS not service static content issue.

Lon

Answer 6

Open IIS -> go to advanced settings of selected website and open Physical Path Credentials -> Select specific user and enter your local user credentials. Open below screenshot for further visualising the things: IIS Settings

Amery