I have an intranet site that is using WindowsAuthentication and it is the first ASP.NET project I've done using that.
I have read in several books (Microsoft, etc.) that recommend putting <deny users="?" /> in the authentication section of the web.config. Once I did this, I occasionally when browsing the site with IE8, I get a "Connect to {SITE}" dialog. If I click the cancel button, I see the page content and everything seems fine. However, if I refresh the page, I get a "You are not authorized to view this page" (Http Error 401.1) message. If I refresh again, I see no prompr or error and the page displays fine.
If I remove the <deny users="?" /> setting, these issues go away. I can refresh the page multiple times without any issues.
As I am inside the same network, I would expect that my identity is always known, therefore, I should never be seen as anonymous.
...
Go to the complete details ...