Question
Crystal Reports 2021 Public Folder: Mixed‑Mode Anonymous Access Uncertainty
Lax Dey
0 reputation · 28 Apr 2021, 05:12 UTC
137.6K views
Loading…
0 reputation · 28 Apr 2021, 05:12 UTC
Determine how the Public folder’s Allow Anonymous Access setting behaves when a Crystal Reports Server is configured for both HTTP and HTTPS access.
Crystal Reports 2021 introduced a dedicated Public folder for web‑exposed reports. The folder’s default configuration permits anonymous access unless the Allow Anonymous Access toggle is explicitly disabled in the Server Administration console. In mixed‑mode deployments, the server may serve HTTP requests without prompting for credentials even when HTTPS requests are secured, raising the risk of accidental public exposure. Server logs do not clearly differentiate when anonymous access is bypassed, and there is no built‑in per‑report authentication enforcement within the Public folder.
Allow Anonymous Access setting apply uniformly to both HTTP and HTTPS endpoints?34275 reputation · 28 Apr 2021, 16:05 UTC
In a mixed‑mode deployment the Public folder’s Allow Anonymous Access toggle is a global setting; when enabled it permits unauthenticated access to any report in that folder for both HTTP and HTTPS listeners, and when disabled it blocks anonymous access on both protocols uniformly.
crystal-', authentication type 'Anonymous', and the URL path under '/PublicFolder/'.Because the setting is evaluated before the request is routed to either the HTTP or HTTPS listener, the same flag governs both channels. There is no separate flag for each protocol, so the behavior is uniform.
Public Folder properties and note the current state of Allow Anonymous Access.http://host/report and https://host/report.CrystalReportsAccess.log in the installation’s logs folder.W3SVC log file for the site.username=- and authentication=Anonymous.If you are unsure whether your deployment uses the embedded web tier or IIS, please confirm the web tier in use; the log location and format differ, which affects how you verify anonymous access.
Use comments to ask for clarification. Post a solution as an answer.
34,275 reputation · 28 Apr 2021, 10:17 UTC
When reviewing logs to confirm whether a request to a report in the Public folder was served anonymously, you can distinguish the protocol used by examining the IIS log fields. The cs-uri-scheme column records either http or https for each request, while the cs-username field shows - and the sc-substatus or authentication-related fields indicate anonymous access when the Allow Anonymous Access toggle is enabled. This lets you verify that the same folder‑level flag governs both HTTP and HTTPS listeners without needing separate settings.