Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a subdirectory in my ASP.NET project that contains utility files. They're needed by the code at run time, but I don't want them to be visible over the web.

What is the syntax in a Web.config file to block access to all users to a single subdirectory and all its contents?

share|improve this question

3 Answers 3

up vote 10 down vote accepted

IIS 7 has a new "request filtering" feature. You probably want to use the hidden segments configuration:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <hiddenSegments>
     <add segment="BIN"/>
    </hiddenSegments>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

This causes http://yoursite/bin to not be servable (but http://yoursite/binary still works)

Check out: http://learn.iis.net/page.aspx/143/how-to-use-request-filtering

share|improve this answer
    
that did it, thank you! –  Joel Spolsky Jul 8 '09 at 17:12
1  
But this will also block yoursite/bla/bin/test .... :-( –  Carsten Schütte Jul 7 '13 at 12:19

Your problem is that if IIS simply returns the files ASP.Net will never get a chance to interfere. I believe it can be done by enabling forms based authentication and considerable messing around, but I would simply move the files outside the wwwroot folder.

JR

share|improve this answer

This should work:

<configuration>
  <location path="FolderName">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
  </location>
</configuration>
share|improve this answer
    
That doesn't work because the files are .txt files... I think John Rennie is right that ASP.NET doesn't get a chance to interfere with .txt files. –  Joel Spolsky Jul 8 '09 at 17:08
    
That's good to know, I've always exclusively kept files served through ASP.NET's handlers in my directories accessible via the web so I never ran into this problem –  John Rasch Jul 8 '09 at 19:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.