Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we are running a Windows Server 2003 with IIS 6.0 installed and I need to block access to certain file being exposed to the internet.

Im the virtual folder I have a index.html file with an embed index.swf file. This swf file needs a config.xml file to run (which is in the same folder) and other multiple swf file located in a com folder (also in the same folder).

Here's a diagram :

Virtual folder
    |-> index.html    
    |-> index.swf
    |-> config.xml
    |-> com
         |-> a lot of swf files

How can I possibly restrict the access so the user can't look at the content of the config.xml file and the com folder but can still be able to "run" the index.html (therefore the index.swf and all the other swf files located in the com folder).


share|improve this question
up vote 0 down vote accepted

One technique is to use a Redirect rule that terminates the request if it is for one of the file types you want to block. We use ISAPI_Rewrite (the free version) to do this.

share|improve this answer
Could you explain what you do, because I really can't see what you mean. Even if you rewrite the file will still be accessible, no? – ALOToverflow Feb 24 '10 at 22:57
Good alternative to URLScan as you can do many other things after you add a URL Rewriter to your solution. I had great success with a freeware version found on CodePlex ( and the developer was nice and helpful. – Dscoduc Feb 25 '10 at 5:49
With ISAPI_Rewrite Lite couldn't I look for everything different than index.html, block it and send the user back to index.html? – ALOToverflow Feb 25 '10 at 13:38
@Frank, yes you can do that with little effort. – Jeff Feb 25 '10 at 19:52
Thanks to you, I found a way to do this with a "not so simple" regex I manage to detect any file other than my default.aspx and redirect it. – ALOToverflow Feb 25 '10 at 20:07

How about Microsoft's URLScan? You could include the restricted files in the [DenyUrlSequences] section of the UrlScan configuration file...

If you upgrade to IIS 7.0 on Windows 2008 you can use the built-in Request Filtering option and specifically restrict/hide the files/folders you don't want accessed.

share|improve this answer
I've tried URLScan 3.1, but it doesn't do what I want it to do. In the [DenyExtension] section I've added .xml but this way the index.swf file doesn't have access to it so I'm back where I've started. – ALOToverflow Feb 25 '10 at 13:19

Does the file name have to end with .xml? If you rename it to .config, IIS will not serve the file up

share|improve this answer
I can probably do that for the xml files, but what about the swf files? – ALOToverflow Feb 25 '10 at 12:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.