Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a directory of text files on IIS. I would like this directory to be hidden.

I have set the web.config as follow:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.web>
        <authorization>
            <deny users="*" /> <!-- Denies all users -->
        </authorization>
    </system.web>
</configuration>

But I can still see a full directory listing of the files, as well as access the files over the web.

What am i setting wrong?

I have tried this too:

<system.webServer>
      <security>
          <authorization>
              <remove users="*" roles="" verbs="" />
              <add accessType="Allow" roles="Administrators" />
          </authorization>
      </security>
  </system.webServer>

But that too didn't help me

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The system.web node only affects asp.net files, *.txt files are not affected by it.

To hide the files from all users there are several ways in IIS 7.x, here are two:

In the web.config inside the directory in question:

<system.webServer>
    <security>
        <requestFiltering>
            <fileExtensions>
                <add fileExtension=".txt" allowed="false" />
            </fileExtensions>
        </requestFiltering>
    </security>
</system.webServer>

or

<system.webServer>
    <security>
        <requestFiltering>
            <hiddenSegments>
                <add segment="directoryname" />
            </hiddenSegments>
        </requestFiltering>
    </security>
</system.webServer>

The first one hides all text files, the second one hides the whole url path, both return 404s to the user.

If you want to allow certain users to access the files, these methods wont work. What kind of authentication are you using?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.