我有一个具有自定义身份验证的 ASP.NET MVC3 网站（即 >）。它托管在 IIS 上，仅启用匿名身份验证来支持我们正在进行的一些 SSO 工作。这只是说，从 /Content 请求普通旧文件通常“有效”，例如 https://oursite.com/Content/ourlogo.jpg 按预期在浏览器窗口中打开，无需提供凭据。
但是，在 IE7 和 8 中使用 CSV 文件会出现问题。我已将[im]相关的 CSV 放在 /Content/Documents/hello.csv 中并正常链接到它。当用户单击链接并选择“打开”（而不是“保存”）时，它应该可以使用 Excel 顺利打开。但是，Excel 似乎正在发出额外的身份验证请求，并且系统会提示用户输入用户名/密码。当然，他们没有提供这些凭据，而且 IIS 也不需要它们。如果用户取消提示，他们将再次收到提示，第二次取消后，CSV 将根据需要在 Excel 中打开。
真的很想摆脱这些提示。
生产中的问题在运行 ASP.NET Dev Server 的开发计算机上表现相同，因此这可能不是 HTTPS 或我们在 IIS 上配置的内容的问题。在空的 MVC 站点上进行了测试，将文件放在相同的相对位置。这工作正常。有点让我觉得我们的代码有问题，但我不知道它可能是什么。
希望有任何想法，因为我几乎没有想法了。
I have an ASP.NET MVC3 website with custom authentication (i.e. <authentication mode="None" />). It's hosted on IIS with only Anonymous Auth enabled to support some SSO work we're doing. That's just to say that requesting a plain old file from /Content typically "just works", e.g. https://oursite.com/Content/ourlogo.jpg opens in the browser window as expected without providing credentials.
Having a problem with CSV files in IE7 and 8, however. I've placed the [im]pertinent CSV in /Content/Documents/hello.csv and linked to it normally. When the user clicks the link and chooses "Open", as opposed to "Save", it should open smoothly with Excel. However, it appears that Excel is making additional requests for authentication, and the user gets prompted for username/password. Of course, they don't have those credentials to give, and IIS doesn't want them anyway. If the user cancels out the prompt, they'll get it one more time, and after a second cancel, the CSV opens in Excel as desired.
Really want to get rid of those prompts.
The problem in production behaves the same on my dev machine running ASP.NET Dev Server, so it's probably not a problem with HTTPS or something we configured on IIS. Did a test on an empty MVC site, putting the file in the same relative location. This works correctly. Kind of leaves me thinking there's a problem in our code, but I'm at a loss to what it might be.
Would love any thoughts, as I'm about out of ideas.
发布评论
评论（1）
我们案例中的解决方案是拒绝 IIS 中托管 CSV 的目录的 HTTP 动词 OPTIONS、HEAD 和 PROPFIND。显然 Excel 正在将这些调用作为 WebDAV 的一部分进行。
The solution in our case was to deny the HTTP verbs OPTIONS, HEAD and PROPFIND for the directory hosting the CSV in IIS. Apparently Excel is making these calls as part of WebDAV.