Hi,
For example, if your application uses Windows authentication along with roles-based authorization, then your application will never authorize anyone because instead of actual user identity the application will always see "Local System" account as a current user - just because Cassini currently does not support Windows auth.
Another possibility is that some resources (files, folders) may not be accessible to "Local System" (a.k.a. "NT AUTHORITY\SYSTEM") account under which all applications are running when hosted by Cassini windows service. Local System has access to most files on the computer, except some personal folders.
Other than that, we can't think of other reasons why you would get 403.
Best regards,
UltiDev Team.
Please donate at
http://www.ultidev.com/products/Donate.aspx to help us improve our products.