<authentication mode="Forms">
			<forms name=".AUTHCOOKIE" protection="All" slidingExpiration="false" timeout="10" />
		</authentication>
		
		<authorization>
			<deny users="?" />
			<allow users="*" />
		</authorization>

Taking Advantage of the Integrated Pipeline

The default configuration for all managed modules shipped with IIS 7.0, including the Forms Authentication and URL Authorization modules, uses a precondition so that these modules only apply to content that an  (ASP.NET) handler manages. This is done for backwards compatibility reasons.
By removing the precondition, we make the desired managed module execute for all requests to the application, regardless of content. This is necessary in order to protect our static files, and any other application content with Forms-based authentication.
To do this, open the application's web.config file located in the %systemdrive%\inetpub\wwwroot directory, and paste the following lines immediately below the first <configuration> element:
<system.webServer> 
<modules> 
    <remove name="FormsAuthenticationModule" />    
   <add name="FormsAuthenticationModule" type="System.Web.Security.FormsAuthenticationModule" />    
    <remove name="UrlAuthorization" />    
    <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />    
    <remove name="DefaultAuthentication" />    
    <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />    
</modules> 
</system.webServer> 
  
This configuration re-adds the module elements without the precondition, enabling them to execute for all requests to the application.

<add name="MyHtmHandler" path="*.htm" verb="GET" type="Handlers.MyHtmHandler" />