How to debug "You do not have permission to view this directory or page"?

After I published an ASP.NET Core app to Azure from Visual Studio 2017 I am getting this message when I click on the app url:

It was working fine before. Is there a way to figure out what's wrong with my pushed changes?

You do not have permission to view this directory or page.

That basically a hint that Azure encounter an error while running your web app. Since its in production, it does not show any useful error messages. For testing/debugging purposes you can turn on the Azure detailed messaging, and turn back off when its ready for production. To do so, you have to follow these two steps,

• Login to Azure > App Services (left side menu) > Your Web App > App Service logs (search box is at the top if you can't find it), then turn on Detailed Error Messages or turn on all of the logging options, up to you.
• Now add the following in your Web Config file,
• In your Web Config file add <customErrors mode="Off" /> BEFORE system.web closing tag, </system.web>. Similarly, add <httpErrors errorMode="Detailed"></httpErrors> BEFORE </system.webServer>. Finally, upload the Web Config to Azure and cross your fingers.

If you follow the steps correctly, that will show the error messages in detail and hopefully from there you will figure out what went wrong. Good Luck!

• The fist thing you should do is actually go and check the folders if your war got unpacked inside the webapps folder. for that if your web url is "xyz.azurewebsites.net" then try to open xyz.scm.azurewebsites.net. This should redirect you to KUDU interface where you can see few tabs. From those tabs select Debug Console and then select CMD from the drop down. This should give you a folder structure.Now Go to site->wwwroot->webapps . There check if your war got unpacked.
• If not then try restarting the web app and see id this does the trick. If while creating your app service plan you have selected the Standard pricing tier, change it to premium
• Last but not the list you can enable logging for you app. Then go to Monitoring-> Diagnostics logs . Turn those setting on. Then select Log streaming(Just below Diagnostics logs).

Hope this help.

From my experience, if your login user ID under Azure Active Directory (AAD), you have to modify in Settings:

• Authentication / Authorization
• App Service Authentication, "ON" =>> choose: Log in With Azure Active Directory
• Select 'ActivityProvider', base on your purpose. In my case, I'm using AAD.
• Configured (Express: Existing APP)
• Manage Azure Active Directory: Manage Permission & Manage Application

For Manage Permission ==>> Add, In Delegate Permission, choose: Sign in and read user profile and refresh your browser to login again

You do not have permission to view this directory or page.

This message show when you have restrict ip on IIS config. Check your Web.config file and add your ip address in security section like below:

<security>
<ipSecurity allowUnlisted="false">
<clear />
<add ipAddress="192.168.250.70" allowed="true" />
</ipSecurity >
</security>

Remove it if you do not want to restrict any ip address.

From the error description, it is not very clear about what went wrong here.

You may check whether the deployed files are available or not using Kudu Console.

Also, make sure that your startup file (For ex: index.htm) is added to the default documents section.

I would suggest you refer Enable diagnostics logging for web apps in Azure App Service and Troubleshoot ASP.NET Core on Azure App Service to check the complete error details and root cause.

In my case Azure DevOps was creating deployment package within extra build folder, so path was build/wwwroot instead of just wwwroot.

I had to uncheck 'Prepend root folder name to archive paths' on my build pipeline.

Azure Pipelines

If you are using Azure Pipelines/Deployments there are some ways this goes wrong. Specifically, your output may be missing some of the files needed, or be structured incorrectly, for IIS to launch your app. The issue can arise for different reasons.

Archive contains root directory.

When you create your zip file, make sure you are not archiving the root folder. What happens is your /home/site/wwwroot directory looks like:

/home/site/wwwroot
    --RootFolder
      --LaunchFile

When IIS is expecting

/home/site/wwwroot
    --LaunchFile

This is easy to fix by adding includeRootFolder: false to the ArchiveFiles@2 task.

- task: ArchiveFiles@2
  displayName: 'Archive files'
  inputs:
    includeRootFolder: false

Alternatively, if using the Web UI in the Root folder or file to archive section ensure that Prepend root folder name to archive paths is not checked.

Build vs Publish

Using the .NET Core task to build the project or solution can result in output that will not work in the /home/site/wwwroot directory. The key here is to choose the publish option, not the build option. build was working for us and then did not for one of our projects. Changing to publish made it work again.

- task: DotNetCoreCLI@2
  inputs:
    command: 'build'
    projects: 'MyProj/MyProj.csproj'
    arguments: '--output $(Build.BinariesDirectory)/WhereYouWantFilesForNextStep --configuration Release'

Instead, use the publish command.

steps:
- task: DotNetCoreCLI@2
  inputs:
    command: publish
    arguments: '--configuration Release -o $(Build.BinariesDirectory)/WhereYouWantFilesForNextStep'

Zip File is not Mounted

Zip archives deployed to Azure are stored in

 Directory of D:\home\data\SitePackages

11/03/2021  06:24 PM    <DIR>          .
11/03/2021  06:24 PM    <DIR>          ..
11/03/2021  04:24 PM        66,278,978 20211103162437.zip
11/03/2021  06:24 PM        73,799,022 20211103182443.zip
11/03/2021  06:24 PM                18 packagename.txt

And, if the following Application Setting is provided:

WEBSITE_RUN_FROM_PACKAGE = 1

Then IIS will mount the zip archive specified in packagename.txt to the D:\home\site\wwwroot.

D:\home\data\SitePackages>cat packagename.txt
20211103182443.zip

Note that 20211103182443.zip is the name of one of the .zip file listed in D:\home\data\SitePackages directory. Now if WEBSITE_RUN_FROM_PACKAGE is toggled the contents of D:\home\site\wwwroot will change.

Useful Resources

Additional reading is available at Microsoft Docs: Run your app in Azure App Service directly from a ZIP package.

If you want to examine the contents of the zip file directly, PowerShell will work in the console provided at App Service > Development Tools > Console and has access to the Unzip command.

D:\home\data\SitePackages>PowerShell Unzip -l 20211103162437.zip
Archive:  20211103162437.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
    25600  2013-07-17 23:18   AForge.Genetic.dll
    ...

I deployed the angular application from visual studio code and these are the changes that I have made which got me the application working.

Configuration > Default Documents -

Configuration > Path mappings > Virtual applications and directories (edit the Physical Path)-

my app name is client, you have write your app name site\wwwroot\dist<yourappname>

In fact , you need to upload your index.php file direct to wwwroot (inside "site" foler)

Just to add to the solutions: in my case I updated the application but the application pool was set to "Always On" so something had "confused it". All I had to do was:

• go to the site settings in the Azure portal
• then select configuration under Settings
• then select the General Settings tab on the configuration page
• On the General settings tab switch "Always On" to Off
• and reconnect to your site as normal.
• When the site is back up and running switch "Always On" back to On.

To turn errors on on production I had to set the ASPNETCORE_ENVIRONMENT environment variable to 'Development' which can be found in your app service here:

Another useful workaround is on the page Jimmy pointed out go to "Defaul documents" tab and add the name of your main file (it should be index.html) but if not add it.

That solved my problem.

Some of the answers on here are more generalized, which I consider to be better overall, but if you are working with Azure Pipelines, I do know that a common scenario in deploying an Azure Web App is that the pipeline simply chooses the incorrect deployment method for the pipeline task. In most basic cases for an IIS web app, e.g. ASP.NET, you will want to use WebDeploy. Simply set the parameters below as such:

UseWebDeploy: true
DeploymentType: 'webDeploy'

See the task reference for more details: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-rm-web-app-deployment

You are probably not zipping the right folder on your build pipeline.

I had the same problem and all I had to do to fix it was adding '/build' here:

- task: ArchiveFiles@2
  displayName: 'Archive files'
  inputs:
    rootFolderOrFile: front-end/presentation/build
    includeRootFolder: false

We get this sometimes on build->release of a .net 4.7.2. web app (webdeploy). Rebuild/rerelease usually solves it. Restart/config changes, stop/start, nothing else works.

I deployed straight from VS Code to Azure App Service with no pipelines set up.

In Azure in the App Service, go to configuration and under path mappings the physical path is by default set to site\wwwroot

You might need to tweak this depending on how your application structure looks like after the build

For me, since I built straight into the dist folder and my index.html is directly under that folder, I got it to work with:

site\wwwroot\dist\

But if you have the app name in the folder structure, you might need to do:

site\wwwroot\dist\<app name>\ or similar depending on where the initial file(e.g index.html) is

My issue was related to aud in the token. In Azure AD you can either have the ApplicationId being populated. Or a more readable string (the url)

When I checked the configuration. Only the applicationId was allowed and not the url.

Thanks to this answer: https://stackoverflow.com/a/55298552/11348049

In the azure function. Navigate to authentication on the left tab. Edit the one in the list.

Then add the url to Allowed token audiences.

This error message can also appear if you're using an API app in Azure App Service and have set authentication to return 401 Unauthorized. The solution is to set it to 302 redirect instead or make sure your http requests are sent with auth headers.

I faced the similar issue . I resolved it by clicking on AppServices=>Authentication=> here make sure your remove the authentication. After removing the authentication. Here how it looks --

Just need to add SCM_DO_BUILD_DURING_DEPLOYMENT = true in ApplicationSettings.

https://docs.microsoft.com/en-us/azure/app-service/quickstart-nodejs?tabs=windows&pivots=development-environment-vscode