ASP MVC in IIS 7 results in: HTTP Error 403.14 - Forbidden

Maybe it's useful to someone: After converting my app to MVC 4 with .NET framework 4.5 and installing the framework on my server with IIS 7.0 I encountered the same 'forbidden' error mentioned in the question. I tried all options described above to no avail, when I noticed the

<system.webServer>
 <modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>

was missing from my web.config. After adding this, everything worked. Simple, but easy to overlook...

EDIT:

Of course the solution above will work, but it is indeed a waste of resources. I think it is better to add the routing module as pointed out by Chris Herring in the comments.

<system.webServer>
  <modules>
    <remove name="UrlRoutingModule-4.0" />
    <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="" />
  </modules>
</system.webServer>

---

Answered on SO here, question: 403 - Forbidden on basic MVC 3 deploy on iis7.5

Run aspnet_regiis -i. Often I've found you need to do that to get 4.0 apps to work. Open a command prompt as an Administrator (right click the command prompt icon and select Run as Administrator):

cd \
cd Windows\Microsoft.NET\Framework\v4.xxx.xxx
aspnet_regiis -i

Once it has installed and registered, make sure you application is using an application pool that is set to .NET 4.0.

UPDATE: I just found an issue with this command. Using -i updated all application pools to ASP.NET 4.0.

Using aspnet_regiis -ir installs the version of ASP.NET but does not change any web applications to this version. You may also want to review the -iru option.

---

I too ran into this error. All the configuration and permissions were correct. But I forgot to copy Global.asax to the server, and that's what gave the 403 error.

---

It's because of being too sure about what you (me) are doing!

On my machine there is IIS 7 installed but the required ASP.NET component (Control Panel->Programs->Turn On/Off->ASP.NET) was not.

So installing this solved the problem

---

I had the same issue. This Microsoft support article fixed it for me.
https://support.microsoft.com/en-us/help/2023146/mvc-2-and-asp.net-4-web-forms-applications-that-use-url-routing-might-return-http-404-errors-when-they-attempt-to-process-extensionless-urls-on-iis-7-and-iis-7.5

In the "Turn Windows Features On or Off" dialog box of the Windows Control Panel "Programs and Features" application, perform the following steps:

Navigate to the following node: Internet Information Services --> World Wide Web Services --> Common HTTP Features Make sure that the "HTTP Error Redirection" option is selected.

-or-

Navigate to the following node: Internet Information Services --> World Wide Web Services --> Performance Features Make sure that the "Static Content Compression" option is selected. After either option has been selected, click "OK" to save changes.

Re-enabling either the HTTP Error Redirection module or the Static Content Compression module ensures that ASP.NET and IIS correctly synchronize HTTP pipeline events. This enables the URL routing module to process extensionsless URLs.

---

In my case following approach helped me out:

aspnet_regiis -i in Windows\Microsoft.Net\Framework Adding modules to system.webServer ...

---

Try to apply the following settings shown below:

1) Give the necessary permission to the IIS_IUSRS user on IIS Server (Right click on the web site then Edit Permissions > Security).

https://i.stack.imgur.com/9ZbK2.png

2) If you use .NET Framework 4, be sure that .NET Framework version is v4.0 on the Application Pool that your web site uses.

https://i.stack.imgur.com/21tVk.png

3) Open Commanp Prompt as administrator and run iisreset command in order to restart IIS Server.

Hope this helps...

---

Please also check, if you are running x64, that you have enabled 32-bit applications in the app pool settings

https://i.stack.imgur.com/Hv0KX.png

---

On the Uncheck "Precompile During Publishing" - I was getting the 403.14 error on a web service I had just written in VS2015 so I rewrote it in VS2013 and was getting the same error. In both cases I had "Precompile During Publishing" on. I unchecked it but was still getting the error. In my case I also had "Delete all existing files prior to publish" but was not deleting everything from the target directory on the server before copying the new published files there. If you don't do that - a "PrecompiledApp.config" file is left behind which causes the problem. Once I deleted that file I was golden on both the VS2013 and VS2015 versions of my web service.

---

I read through every answer here looking for something that worked before I realized that I'm using IIS 10 (on Windows 10 version 2004) and this question is about IIS 7 and almost a decade old.

With that said, run this from an elevated command prompt:

dism /online /enable-feature /all /featurename:IIS-ASPNET45

The /all will automatically enable the dependent parent features: IIS-ISAPIFilter, IIS-ISAPIExtensions, and IIS-NetFxExtensibility45.

After this, you'll notice two new (in my environment at least) application pool names mentioned .NET v4.5. ASP.NET web apps that were previously using the DefaultAppPool will just work.

https://i.stack.imgur.com/6XDAR.png

---

Control Panel > turn windows features on or off > Web Server > Application Development

Check ASP.NET

---

Please note sometimes wrong Managed pipeline mode will cause this error. There are two choices to select integrated and classic.

---

How to Fix “HTTP Error 403.14 – Forbidden The Web server is configured to not list the contents of this directory”

This error occurs when you have MVC 2+ running hosted on IIS 7+, this is because ASP.NET 4 was not registered in IIS. In my case I was creating a MVC 3 project and hosting it on IIS 7.5.

To fix it, make sure you have MVC 2 or above and .Net Framework 4.0 installed, then run a command prompt as administrator and type the following line:

32bit (x86)

%windir%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe -ir

64bit (x64)

%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -ir

---

Check your Global.asax file. In my case, it was empty.

---

If the top answers don't work, look for a config named PrecompiledApp.config in the hosting directory and delete it if it exists. This file prevents IISExpress and LocalIIS to work properly. (And I think that's a bug) The content of the file in my case was:

<precompiledApp version="2" updatable="true"/>

And I'm 100% positive that was the problem with my case since I tried everything in 2 hours and tested lots of times with this config.

One more thing: You cannot use aspnet_regiis in newer versions of Windows and IIS so try

dism /online /enable-feature /featurename:IIS-ASPNET45 /all

---

I tried everything here; nothing worked. Problem was in my Web.config file, somehow dependent assembly binding got changed from minimum 1 to minimum 0.

<!-- was -->
<runtime>
    <assemblyBinding>
        <dependentAssembly>
            <assemblyIdentity name="System.Web.Mvc" />
                <bindingRedirect oldVersion="0.0.0.0-5.2.3.0" newVersion="5.2.3.0" />


<!-- should have been -->
                <bindingRedirect oldVersion="1.0.0.0-5.2.3.0" newVersion="5.2.3.0" />

---

NOTHING WORKED IN THE WORLD FOR ME,

I found out the problem and this might be helpful for someone,

Applicable if you are using Plesk, I just turned this thing off and everything started to work.

Yet, I do not know what is the exact issue with it.

https://i.stack.imgur.com/SQ16R.png

---

I have also encountered this same error, despite all the provided solutions for the following reasons:

Missing DLLs

Database connection string points to an inaccessible server.

---

In my case web.config and all files except for the /bin folder were missing (not copied somehow). Silly, but that was the last thing I have checked.

---

I recently had this error and found that the problem was caused by the feature "HTTP Redirection" not being enabled on my Windows Server. This blog post helped me get through troubleshooting to find the answer (despite being older Windows Server versions): http://blogs.msdn.com/b/rjacobs/archive/2010/06/30/system-web-routing-routetable-not-working-with-iis.aspx for newer servers go to Computer management, then scroll down to the Web Server role and click add role services

---

With ASP.NET project with C# 4.5 I've solved such problem by installing ASP.NET extension in Web Platform Installer

---

Also one more things can be possible

install .net framework 4.0 manually

This solution is for IIS7 on window 7

open cmd with administration previleges

go to directory "C:\Windows\Microsoft.NET\Framework\v4.0.30319"

type aspnet_regiis.exe -i

got to your inet manager by typing in run command "inetmgr"

refresh your IIS7

reload the site.

---

I know you had this problem in an internal host, but I had experienced such an issue before in an external host and in my case it had it's own resolution, maybe it could save somebody's time:

In fact my website was STOPPED by some reason which currently I'm not aware of, to check it out if you have the same problem, in WebsitePanel main page go to Web -> Websites then select the domain name of your website from the list, after that in the right side of the page just opened, check if you see the word STARTED, else if you see the word STOPPED, make it get started again. That's all.

---

I know this is an old topic, but you can also get this error (when you are debugging) if you have a folder named the same as a route in a controller.

For instance, if you have a UserController, with a route called /User and you ALSO have a folder in your solution called "User" then IISExpress will try to browse the folder instead of showing your view.

---

After trying every solution suggested here, I found yet another possible solution: URLScan

The IIS had WebDAV disabled, even in the web.config of my application, WebDAV's handler and module was removed. PUTs still returned a 403 - Forbidden without any log entries in the IIS logs. (GET / POST worked fine).

Turns out the IIS had an active ISAPI Filter (the URLScan) enabled which prevented all PUTs. After removing URLScan, it worked for me.

---

My situation was completely different than any of these and the 403:Forbidden error message was a little bit of a red herring.

If your Application_Start() function in the Global.asax module tries to access the web.config and an entry that it's referencing isn't there, IIS chokes and (for some reason) throws the 403:Forbidden error message.

Double-check that you aren't missing an entry in the web.config file that's attempting to be accessed in your Global.asax module.

---

In case you're like me and have an application using NHibernate and the above answers have not resolved your issue.

You should look at the connection string in your application; possibly in the webconfig file to ensure it is correct.

---

I have been using Identity Impersonate:

<system.web>
    <identity impersonate="true" userName="domain\username" password="password"/>
</system.Web>

When pushing up to the server you have to give the username access to the Temporary ASP.NET Files folder so it can read/write/execute properly:

C:\Windows\Microsoft.NET\"frameworkversion"\"aspversion"\Temporary ASP.NET Files

Obviously replace "frameworkversion" and "aspversion" with the versions you are using.

---

Step 1: Select the Site For which the HTTP Error is produced in IIS and then click on Directory Browsing as shown in the image below:

Step 2: In the Directory Browsing Window in IIS click on Enable in Actions on the right side as shown in the diagram below:

Now Directory Browsing is enabled for your asp.net website, just restart the web application in IIS and Browse the site in your browser and see the result.

---

I'm using: Win Server 2012 R2 / IIS 8.5 / MVC4 / .Net 4.5

If none of the above worked then try this:

Uncheck "Precompile during Publishing"

This kicked my butt for a few days.

---