title: POST 403 Forbidden for ScriptResource.axd
body: <p>We're running into a strange issue with the development version of one of our websites. When triggering a postback on the page through a <code>DropDownList</code> <code>OnChange</code> event, the following error is displayed in the browser console:</p>
  
  <pre><code>POST &lt;URL here&gt; 403 (Forbidden)
  Uncaught #&lt;Error&gt;
  </code></pre>
  
  <p>Viewing the generated IIS error page is not helpful. It indicates the following:</p>
  
  <pre><code>Module  ManagedPipelineHandler
  Notification    ExecuteRequestHandler
  Handler PageHandlerFactory-Integrated-4.0
  Error Code  0x00000000
  </code></pre>
  
  <p>This is for a <code>ScriptResource.axd</code>. Now here's the strange part: this issue didn't start happening until our other developer started publishing the site. Previously, I was publishing it with no issues. There have been no <code>web.config</code> changes (in fact, it's identical to our production <code>web.config</code>, which works perfectly). I've scoured the web for clues regarding why we would be getting this issue, and it seems to be mostly related to either the <code>&lt;handlers&gt;</code> section in <code>&lt;system.webServer&gt;</code>, or the <code>&lt;httpHandlers&gt;</code> in <code>&lt;system.web&gt;</code>. The relevant sections are listed below:</p>
  
  <pre><code>&lt;httpHandlers&gt;
    &lt;remove verb="*" path="*.asmx" /&gt;
    &lt;add verb="*" path="*.asmx" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add verb="*" path="*_AppService.axd" validate="false" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" validate="false" /&gt;
  &lt;/httpHandlers&gt;
  
  &lt;handlers&gt;
    &lt;remove name="WebServiceHandlerFactory-Integrated" /&gt;
    &lt;remove name="ScriptHandlerFactory" /&gt;
    &lt;remove name="ScriptHandlerFactoryAppServices" /&gt;
    &lt;remove name="ScriptResource" /&gt;
    &lt;add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
  &lt;/handlers&gt;
  </code></pre>
  
  <p>From what I've seen, this appears to match what other users say works well for them. One interesting thing of note is that the 403 Forbidden appears to be on <code>POST</code>. I did try adding <code>POST</code> as a verb in both of those locations for <code>ScriptResource.axd</code>, but this did not work either.</p>
  
  <p>The website is hosted in IIS 7.5 under an Application Pool using Network Service. Network Service does have full control under the root folder for the website.</p>
  
  <p>At this point, I'm at a complete loss as to what could be causing our bizarre issue.</p>