Why am I able to access the images by URL in the the SiteCollectionImages document library in a standard SharePoint 2013 publishing site when I am not authenticated?

Scenario : user is not authenticated and accesses:

  1. http://sitecollection/publishingsite/SiteCollectionImages/image1.png -> works, the image is displayed
  2. http://sitecollection/publishingsite/SiteCollectionImages/ -> correctly redirects to the FBA authentication page.

Note: There is no anonymous authentication enabled at all. There is no blob cache enabled. On the web application, there is NTLM and FBA authentication enabled.

In the ULS log, it looks like SharePoint is aware that the request is not authenticated, but goes ahead and serves the file anyway.

What can I do to stop images being served when accessed by the full URL?

  • Can you please explain how you tested this usecase? – Amal Hashim Jan 22 '15 at 15:37
  • I tested by accessing the two URLs in the scenario above in a Chrome Icognito browser, then a IE Private session, to ensure there's no authentication cookie left: this works, for accessing the second link in the scenario above correctly redirects to the FBA authentication page. – Tudor Olariu Jan 22 '15 at 15:40

SiteCollectionImages image library has unique permissions. Also you can see Style Resource Readers has given Read permission on the library.

Internally Style Resource Readers contain NT Authority\Authenticated Users.

So the users are somehow authenticated while accessing the images. You can fire up fiddler to understand the actual communication happening between the request and the server.

  • This can't be happening, the request is really not authenticated. With the FBA authentication and a private browser session, there's no cookie misbehaviour; also, in the ULS SharePoint is reporting that IsAuthenticated=false for this request ... but then on the next line is happy to report that it serves the image. – Tudor Olariu Jan 22 '15 at 15:48
  • Strange. Can you please check the communication using Fiddler. I don't have the setup currently to investigate. – Amal Hashim Jan 22 '15 at 15:48
  • Fiddler reports: No Proxy-Authenticate Header is present. No WWW-Authenticate Header is present. ; everything else looks like a really normal and regular request – Tudor Olariu Jan 22 '15 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.