difference between mime types and extension filtering on IIS?

Question

I got error 404 for a file extension. I did allow it in extension filter it didn't solve, whereas in mime type it's then ok. So what's the purpose of adding a file extension ?

Answer 1

If MIME Type is not defined IIS will return 404.3 code. Apparently this behaviour is by design.

In a nutshell a mime type is a setting which IIS uses to determine how a particular file type is managed. For instance IIS will have a mime type set for the .html extension which will instruct the client web browser to treat the file as text, while the mime type for an .mpg file is configured as a video file which will require an external application outside the web browser. Windows file associations work in a very similar way. Boiled down it simply is a method that is used so that IIS is able to instruct the client on how to deal with files that are being delivered.

"Extension filtering" (Request Filtering -> File Name Extensions) became part of IIS as of v7. For IIS v7.0 you had to download Administration Pack to have it.

Request Filtering is a built-in security feature that replaces much of the functionality that was available through the UrlScan add-on for IIS 6.0. When Request Filtering blocks an HTTP request, IIS 7 will return an HTTP 404 error to the client and log the HTTP status with a unique substatus that identifies the reason that the request was denied. 404.7 = File Extension Denied.

With help of Request Filtering you can configure your website/application to not to serve files with specific extensions which otherwise would be available to download. Just an example (not the best, but): lets assume that any *.inc file will be served as plain text, but one of your websites uses this extension for a different purposes (to store some configuration details, for example). This can be easily achieved with the help of Request Filtering.

You can also configure it other way around -- to deny all extensions (for static files only) except those that are explicitly allowed.