Please read this post by Fredrik for the background. There is also a thread in the EPiServer forums here.

So, this problem got highest priority due to a increasing number of customers experiencing this problem. I've been live debugging EPiServer CMS and ASP.NET code today which finally led to me to the cause of the problem, it is actually very cool to be able to set break points in the source code from Microsoft and modify private variables to trigger error conditions.

I found the cause pretty quickly after I found out that the forms authentication calls into the resource loader, the next step was to trigger a request for a file without the handler for WebResource.axd registered.

Repro

1) Forms authentication enabled (because FormsAuthenticationModule.OnEnter calls into AssemblyResourceLoader.IsValidWebResourceRequest)

2) Trigger a restart of the web application (save web.config, iisreset etc)

3) First request must be on a path backed by a Virtual Path Provider (or other location without the WebResource.axd registered). FormsAuthenticationModule will cause the initialization of AssemblyResourceLoader.EnsureHandlerExistenceChecked to be run under a context where WebResource.axd is not registered.

4) Open a ASPX that requires a web resource, it will crash with error “The WebResource.axd handler must be registered in the configuration to process this request” even if a valid WebResource.axd registration exist for that path.

5) The problem will not go away until a restart of the web application is made.

Possible workaround

For each and every Virtual Path Provider add the WebResource.axd handler before the wildcard mapping to StaticFileHandler in EPiServer CMS, for example:

   1: <location path="VPPFolder">

   2:   <system.web>

   3:     <!-- Setup the StaticFileHandler for the wildcard mapping to work in IIS6 -->

   4:     <httpHandlers>

   5:       <add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="True"/>

   6:       <add path="*" verb="GET,HEAD" type="EPiServer.Web.StaticFileHandler, EPiServer" validate="true" />

   7:     </httpHandlers>

   8:   </system.web>

   9:   <staticFile expirationTime="-1.0:0:0" />

  10: </location>

The fix

Its reported to Microsoft and I really hope that they will fix it as soon as possible, especially when .NET 3.5 SP1 is around the corner. I have a plain vanilla ASP.NET project to reproduce the problem also if someone is interested.