locahost 和ip的区别是ip属于internet区域,localhost属于本地信任域
看IIS的帮助,IIS的安全验证顺序(特别是对于NTFS分区)
The following is an outline of the access control process:
1.The client requests a resource on the server.
2.The IP address of the client is checked against any IP address restrictions in IIS. If the IP address is denied access, then the request fails and a "403 Access Forbidden" message is returned to the user.
3.The server, if configured to require it, requests authentication information from the client. The browser either prompts the user for a user name and password, or offers this information automatically.
4.IIS checks if the user has a valid Windows user account. If the user does not, then the request fails, and a "401 Access is denied" message is returned to the user.
IIS checks if the user has Web permissions for the requested resource. If the user does not, then the request fails, and a "403 Access Forbidden" message is returned to the user.
5.Any security modules, such as Microsoft ASP.NET impersonation, are added.
IIS checks the NTFS permissions on static files, Active Server Pages (ASP), and Common Gateway Interface (CGI) files for the resource. If the user does not have NTFS permissions for the resource, then the request fails, and a "401 Access is denied" message is returned to the user.
6.If the user has NTFS permissions, the request is fulfilled.