5

I don't want to remove entries from MIME lists, I just want to tell IIS to stop serving files with a particular extension.

Why is it so difficult to get IIS to do something so simple as stop serving a file with a particular extension?

I've seen solutions like... add a mapping pointing some some 404.dll, which only exists in some separate lockdown toolkit that claims to be obselete for IIS 6.0+ anyway. I've also read that one can have ASP.NET explicitly forbid serving the file, by creating a mapping to the asp.net handler dll, then specifying the System.Web.HttpForbiddenHandler in the web.config for the filetype. Those work, although at first then forbidden handler didn't appear to work, thanks to the browser cache, LOL: (see answer at http://stackoverflow.com/questions/208571/castleproject-vm-httpforbiddenhandler-not-work).

I'm just looking for a simple solution here.

Improve this question
3
  • Server question.
    – le dorfier
    Jun 16, 2009 at 17:22
  • Server question? Web-application configuration question?
    – Triynko
    Jun 16, 2009 at 17:24
  • Web app config methinks...belongs on SO.
    – Kev
    Jun 16, 2009 at 17:35

3 Answers 3

Reset to default
3

I wouldn't let another users poorly explained problem put you off using the System.Web.HttpForbiddenHandler approach. I suspect he probably has other issues not adequately explained in his question.

With regard to mapping .fla to the ASP.NET ISAPI extension and using the System.Web.HttpForbiddenHandler, this works perfectly well and we've never had 'caching' issues. Have you actually tried this rather than listen to hearsay?

Your other approach is to remove the associated mime-type, either globally, or at the site level.

"Why is it so difficult to get IIS to do something so simple as stop serving a file with a particular extension?"

Without sounding cheeky, none of the above are difficult, that's how it's done and it's not much work to implement.

Improve this answer
0

Simple solutions

  1. Don't put the files in your web accessible directories
  2. Put them there with an extension that already isn't served -- I do this a lot -- I add .config to files I don't want served -- that way I don't have to change IIS.
Improve this answer
2
  • 1. I wouldn't, except that I have a reason for them to be there. 2. That's impractical, and falsifying the extension is an absurd thing to do simply because IIS lacks a basic feature. I'm dealing with FLA and SWF files, which are kept in the same directory so the FLA files can be updated and recompiled to the SWF, which is served.
    – Triynko
    Jun 16, 2009 at 17:29
  • If I can't change that IIS is required and I can't change the configuration, it's the only way, even if it's absurd.
    – Lou Franco
    Jun 16, 2009 at 21:48
0

In IIS 7 it is easier because you can just modify the web.config to make any file type forbidden. In IIS 6, only file types that are registered to be handled by the ASP.NET ISAPI filter are affected by web.config settings.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .