Home / server / Questions / 37762
Accepted
Joel Spolsky
Asked: 2009-07-09 08:01:55 +0800 CST

Block access to subdirectory using Web.config

  • 772

I have a subdirectory in my ASP.NET project that contains utility files. They're needed by the code at run time, but I don't want them to be visible over the web.

What is the syntax in a Web.config file to block access to all users to a single subdirectory and all its contents?

asp.net iis-7

4 Answers

  1. Best Answer

    IIS 7 has a new "request filtering" feature. You probably want to use the hidden segments configuration:

    <configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <hiddenSegments>
     <add segment="BIN"/>
    </hiddenSegments>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

    This causes http://yoursite/bin to not be servable (but http://yoursite/binary still works)

    Check out: http://learn.iis.net/page.aspx/143/how-to-use-request-filtering

    • 16

  2. Your problem is that if IIS simply returns the files ASP.Net will never get a chance to interfere. I believe it can be done by enabling forms based authentication and considerable messing around, but I would simply move the files outside the wwwroot folder.

    JR

    • 1

  3. This should work:

    <configuration>
  <location path="FolderName">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>
</configuration>
    • 0

  4. MattB's solution will work, but if you have the same folder name in other sub directories, those sub directories will not work.
    You could try the following.

    <?xml version="1.0" encoding="utf-8"?>
<configuration>
  <!-- Make sure this directory cannot be served. -->
  <location path="Plugins"> <!-- Change this to your path -->
    <system.webServer>
      <handlers>
        <add name="DisallowServe" path="*.*" verb="*" type="System.Web.HttpNotFoundHandler" /> <!-- Return 404 instead of 403 -->
      </handlers>
    </system.webServer>
  </location>
</configuration>
    • 0