Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a subdirectory in my ASP.NET project that contains utility files. They're needed by the code at run time, but I don't want them to be visible over the web.

What is the syntax in a Web.config file to block access to all users to a single subdirectory and all its contents?

share|improve this question
up vote 13 down vote accepted

IIS 7 has a new "request filtering" feature. You probably want to use the hidden segments configuration:

     <add segment="BIN"/>

This causes http://yoursite/bin to not be servable (but http://yoursite/binary still works)

Check out:

share|improve this answer
that did it, thank you! – Joel Spolsky Jul 8 '09 at 17:12
But this will also block yoursite/bla/bin/test .... :-( – Carsten Schütte Jul 7 '13 at 12:19

Your problem is that if IIS simply returns the files ASP.Net will never get a chance to interfere. I believe it can be done by enabling forms based authentication and considerable messing around, but I would simply move the files outside the wwwroot folder.


share|improve this answer

This should work:

  <location path="FolderName">
        <deny users="*"/>
share|improve this answer
That doesn't work because the files are .txt files... I think John Rennie is right that ASP.NET doesn't get a chance to interfere with .txt files. – Joel Spolsky Jul 8 '09 at 17:08
That's good to know, I've always exclusively kept files served through ASP.NET's handlers in my directories accessible via the web so I never ran into this problem – John Rasch Jul 8 '09 at 19:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.