First of all, since our web application is built from HTML files and not ASPX or ASP.NET MVC controllers, we need to be able to have security in place for these as well, so we get redirected to a login page when not authenticated. There are a couple of approaches one can choose in order to make the security pipeline of ASP.NET kick in for static files such as HTML files; one of the approaches could be to enable all the HTTP modules to run for all the requests, but that would mean a potential performance hit for static content. So instead, we're going to tell ASP.NET to deal with the .html files specifically: