The usual behavior of IIS 6.0+ is to throw a 404 error when a client tries to access a file that does not have an associated MIME type in IIS settings.

Does it mean that it is safe to assume that those files are protected from unauthorized access? I would like to know if there is a way for a remote client to force start the download of files with unknown file types given that IIS settings remain untouched.


No, this is not possible considering the design of IIS. For a file to be served to a client it needs to have a supported MIME type in IIS.

There could be a bug in IIS to allow this, but considering the maturity of the product this is unlikely at this time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.