Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a subdirectory in my ASP.NET project that contains utility files. They're needed by the code at run time, but I don't want them to be visible over the web.

What is the syntax in a Web.config file to block access to all users to a single subdirectory and all its contents?

share|improve this question
add comment

3 Answers

up vote 9 down vote accepted

IIS 7 has a new "request filtering" feature. You probably want to use the hidden segments configuration:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <hiddenSegments>
     <add segment="BIN"/>
    </hiddenSegments>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

This causes http://yoursite/bin to not be servable (but http://yoursite/binary still works)

Check out: http://learn.iis.net/page.aspx/143/how-to-use-request-filtering

share|improve this answer
    
that did it, thank you! –  Joel Spolsky Jul 8 '09 at 17:12
1  
But this will also block yoursite/bla/bin/test .... :-( –  Carsten Schütte Jul 7 '13 at 12:19
add comment

Your problem is that if IIS simply returns the files ASP.Net will never get a chance to interfere. I believe it can be done by enabling forms based authentication and considerable messing around, but I would simply move the files outside the wwwroot folder.

JR

share|improve this answer
add comment

This should work:

<configuration>
  <location path="FolderName">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>
</configuration>
share|improve this answer
    
That doesn't work because the files are .txt files... I think John Rennie is right that ASP.NET doesn't get a chance to interfere with .txt files. –  Joel Spolsky Jul 8 '09 at 17:08
    
That's good to know, I've always exclusively kept files served through ASP.NET's handlers in my directories accessible via the web so I never ran into this problem –  John Rasch Jul 8 '09 at 19:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.