What is the best way to override _forms/default.aspx?

Question

I've got FBA enabled. Created custom login page, which uses two factor authentication. It is all working fine, same as /_forms/default.aspx.

However, I'd not like users to use /_forms/default.aspx as a back-door and skip additional security check at login.

What is the the best approach for this scenario?

I can do that as modifying web.config for _forms: <deny users="*" /> But it seems like a hack. — Milen, Nov 5, 2013 at 10:29

John Chapman · Accepted Answer · 2013-11-06 14:41:42Z

You can override the login page on the web application settings in Central Administration. You would need to create a login page to replace it with. There are a number of examples on the web, here is one you could start with: http://sivarajan.me/post/SharePoint-2013-Enabling-Custom-Login-Page-and-Mixed-Contents-Part-2

EDIT

To answer your revised question, you can redirect the page at the IIS level. The URL Rewrite module for IIS could handle this for you: http://www.iis.net/downloads/microsoft/url-rewrite

1 Answer 1