ASP.Net: Problems loading WebResource.axd

Question

(See also IIS - Ajax Problems when migrating to Windows Server 2022 and https://stackoverflow.com/questions/77523244/ajax-problems-when-migrating-to-windows-server-2022?noredirect=1#comment136677824_77523244)

I am trying to migrate a running ASP.Net WebApp to a new server (Windows Server 2022). After some investigation I see that there are problems loading

https://<My Temp URL>/WebResource.axd?d=6w3y_2UcMA_...

What I did:

I checked out all sources for this website, compiled it and tested it in Microsoft Visual Studio Community 2022 (64-Bit) using IIS Express and Microsoft Edge. This works fine without errors.

Then I set up a new website with Plesk Obsidian and in IIS Manager I set the physical path to the root of my development version. I also set full access for the identity generated by Plesk to this directory and all subdirectories. Now the website is only loaded partially with errors like

Laden fehlgeschlagen für das <script> mit der Quelle "https://debug.romantic-wing.85-215-161-205.plesk.page/WebResource.axd?d=6w3y_2UcMA_vpqiwTFf-BMlx60cPDSWd8TxJmm4FXKldlfqb6-IrUpMzQnAcHmrSZgV47Mah2sXpwJVI0&t=638344119423008439".

This script is referenced by

<script src="/WebResource.axd?d=6w3y_2UcMA_vpqiwTFf-BMlx60cPDSWd8TxJmm4FXKldlfqb6-IrUpMzQnAcHmrSZgV47Mah2sXpwJVI0&t=638344119423008439" type="text/javascript"></script>

Trying to load this URL directly in a browser causes

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

Why do I only get these problems in IIS, not in my development environment? Hopefully this is just a problem of security settings?

Answer 1

I could partially solve my problem:

Plesk generates identites like IWPD_6(romantic-_we) the website will be running under. I guess that this user does not have enough access rigthts to load / execute this script. As a test, I set my own user account as identity and the WebApp works fine.

As I mentioned before, I set full access to the whole directory tree for this Plesk generated identity. What security settings are missing?