Allow Anonymous Access to ForgotPassword Page - asp.net-mvc

Question

I have a link to /ForgotPassword on my Login page. When it's clicked, I'm just redirected to /Login?ReturnUrl=%2fForgotPassword. This is an MVC5 app using Form-based authentication. I'm attempting to use AllowAnonymous, but it isn't working.
Web Config:
<location path=".">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
<location path="Content">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<location path="Scripts">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<location path="App_Themes">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
<authentication mode="Forms">
<forms loginUrl="~/Login" timeout="15"/>
</authentication>
ForgotPassword Controller:
[AllowAnonymous]
public class ForgotPasswordController : Controller
{
[AllowAnonymous]
public ActionResult Index()
{
return View();
}
}
No such luck. Aside from a _ViewStart, I can't find anything that is being used that should be decorated with AllowAnonymous.
What I'm a missing here? Thanks!

Answer 1

don't use authorization tags in we.config, use only authorization attributes in controllers and actions.
authorization tags in web.config are useful to allow/restrict Access to files and it Works well with web forms and static content.
But in MVC there is routes which is mapped to controllers and actions, and you may have different actions in the same controller with different authorization tags, e.g.: you can use [Authorize] for the whole controller, and allow only one action for anonymouse users by using [AllowAnonymous] attribute to the desired action only.
read more here: https://weblogs.asp.net/jongalloway/asp-net-mvc-authentication-global-authentication-and-allow-anonymous