Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are serving up files for our own application for download from web servers, including IIS. One such file has the .config extension. Turns out that IIS won't serve this because it thinks it's a config file of its own. I'm thinking of using just .configuration instead. Will this be OK? Is there a list of 'forbidden' extensions for serving from IIS?

share|improve this question
up vote 1 down vote accepted

Yes there is a list of extensions to block called Request Filtering, you can run: appcmd list config -section:system.webServer/security/requestFiltering you will see something like: ... ...

in my Windows 7 machine the list includes:
.asa,.asax,.ascx,.master,.skin,.browser,.sitemap, .config,.cs,
.csproj,.vb,.vbproj,.webinfo,.licx,.resx, .resources,.mdb,.vjsproj,
.java,.jsl,.ldb,.dsdgm,.ssdgm, .lsad,.ssmap,.cd,.dsprototype,
.lsaprototype,.sdm, .sdmDocument,.mdf,.ldf,.ad,.dd,.ldd,.sd,
.adprototype, .lddprototype,.exclude,.refresh,.compiled,.msgx,.vsdisco

Note that you can also within your application specify more extensions or allow other extensions that might not otherwise be allowed by using a web.config inside your folder.

Warning do not do this since .config files could include sensitive information.

For example, if you drop a web.config inside your application with the following contents it will let users download .config files:

<?xml version="1.0" encoding="UTF-8"?>
                    <remove fileExtension=".config" />

For more info see:

Finally, if you are going to use some random extension, you need to make sure that IIS also knows what mime type to use and know the extension that you will use if you want to allow static file downloads, and that needs to be inside the staticContent section (appcmd list config -section:system.webServer/staticContent). You can also configure this inside web.config just as above.

share|improve this answer
Thanks. We don't have access to customer servers (either for investigation or to change config). I'm looking for a blacklist of extensions which would be a bad idea on standard deployments. As far as I can tell from that page, it's only .config extension should be avoided. Correct? – Joe Jul 23 '10 at 15:22
no, the list is actually larger, in my Windows 7 machine I have: .asa,.asax,.ascx,.master,.skin,.browser,.sitemap, .config,.cs,.csproj,.vb,.vbproj,.webinfo,.licx,.resx, .resources,.mdb,.vjsproj,.java,.jsl,.ldb,.dsdgm,.ssdgm, .lsad,.ssmap,.cd,.dsprototype,.lsaprototype,.sdm, .sdmDocument,.mdf,.ldf,.ad,.dd,.ldd,.sd,.adprototype, .lddprototype,.exclude,.refresh,.compiled,.msgx,.vsdisco – Carlos Aguilar Mares Jul 24 '10 at 0:49
thank you! Add this list as an answer and I will accept it. – Joe Jul 24 '10 at 12:48
@Joe - I've added the list to this answer. – Carlos Aguilar Mares Jul 24 '10 at 14:40

You could just .zip all your files then you can server any extension you would like.

share|improve this answer
That's not an option, sorry. – Joe Jul 23 '10 at 14:27
figured I would check – jer.salamon Jul 23 '10 at 14:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.