Re:

I think you can't set authentication if you dont set login page for your application. may be, you can try this work around.

Always redirect users to aspx (Should be created as new) page, redirect them to the necessary .asp files by passing some token session or query string. While the asp page gets loaded, check whether you have authenticated token passed by aspx, else put response.end().