0

I have several files on my ASP.NET site that are for use solely by the application. Currently, they can be viewed in a browser by just using the URL. Is there a way to prevent this without actually moving the file or do I need to move the files to a different directory, such as _private?

4
  • Can you tell us what kind of files they are?
    – squillman
    May 29, 2009 at 16:44
  • Certainly, currently just XML/text files.
    – Jeff Yates
    May 29, 2009 at 16:46
  • I realise this may be a very very noob question for ASP stuff, but I am completely new to the admin side, which I need to know at this stage of the project. I appreciate the help.
    – Jeff Yates
    May 29, 2009 at 16:47
  • What version of IIS are you running?
    – notandy
    Jun 1, 2009 at 18:05

3 Answers 3

2

If you are able to install software on the server, you can install Microsofts URLScan for IIS to restrict what files IIS will serve. This will be for the whole server however, rather than just the application.

You should also be able to do so on a site basis, using the web.config file, the details are here, they are for IIS 5 and .net 1.1 but the principal is the same.

1
  • The web.config file change was sufficient for the particular problem - thanks! (I'll upvote when I have better rep)
    – Jeff Yates
    Jun 2, 2009 at 18:13
1

Use the IIS Manager to block them individually by navigating to the file, right clicking on it, and removing the check from the read checkbox.

OR

Use IIS manager to create a rule for a file type (see this web page: support.microsoft.com/kb/815152)

0

Configuration and data files that are for internal use only should be placed in the App_Data folder:

The App_Data Folder

To improve the security of the data used by your ASP.NET application, a new subfolder named App_Data has been added for ASP.NET applications. Files stored in the App_Data folder are not returned in response to direct HTTP requests, which makes the App_Data folder the recommended location for data stored with your application, including .mdf (SQL Server Express Edition), .mdb (Microsoft Access), or XML files. Note that when using the App_Data folder to store your application data, the identity of your application has read and write permissions to the App_Data folder.

What's new in ASP.NET Data Access

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .