0

I have some files which unfortunately need to be located within the web root but should be denied to regular users. However, they do need to be available to one of the web apps running on the server.

Do I need to adjust permissions on the folder in the system (via File Explorer) or from within IIS Manager?

In an ideal world, attempting to access the file via the web server will result in a 404. At the same time, my web application should be able to access it as a normal file.

Note that the user for the web app does not appear to be the same one running IIS.

This is Windows Server 2008, running IIS 6.

1
  • The first step in resolving a problem is to understand how the components involved work. I would say that the statement "Note that the user for the web app does not appear to be the same one running IIS" doesn't convey a definitive level of understanding of how your application works or how IIS is configured. My suggestion would be to determine which security principal the application uses and which security principal IIS uses for the web site in question. If they are in fact two separate security principals then you can secure the web site and the executables appropriately.
    – joeqwerty
    Aug 15, 2013 at 18:05

1 Answer 1

0

This depends specifically on whether you're using anonymous access to these resources or not. If users have to authenticate to IIS using either basic or NTLM style authentication (not going through a custom database or application specific authentication process) then they will have their own access rights to these files. If they connect anonymously to IIS and authenticate to the application then they will be using the application's access rights.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .