I have a strange situation where a single ASP.NET Core Web App I am running on Azure is having issues serving files from a particular directory.

Specifically I am trying to serve a file from the path https://myurl.com/.well-known/acme-challenge/6uVkXzXxHHkm1d6cQiUqI07lrYspInk7i9WCKKl-RlQ I note that this is a slightly unusual url in that the filepath does not contain a file extension and the directory starts with a (.) this is a requirement outside my control.

Unfortunately while I can successfully get this working on nearly all my app service instances I have one where this is failing with the following error:

The requested page cannot be accessed because the related configuration data for the page is invalid. Config Error Cannot read configuration file \?\D:\home\site.well-known\web.config

My web.config looks like this:

<?xml version="1.0" encoding="utf-8"?>
      <!-- Remove WebDAV module so that we can make DELETE requests -->
      <remove name="WebDAVModule" />
      <!-- Remove WebDAV module so that we can make DELETE requests -->
      <remove name="WebDAV" />
      <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
    <!-- When deploying on Azure, make sure that "dotnet" is installed and the path to it is registered in the PATH environment variable or specify the full path to it -->
    <aspNetCore requestTimeout="23:00:00" processPath=".\Nop.Web.exe" arguments="" forwardWindowsAuthToken="false" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" startupTimeLimit="3600" hostingModel="InProcess">
        <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" />
        <environmentVariable name="COMPLUS_ForceENC" value="1" />
        <remove name="X-Powered-By" />
        <!-- Protects against XSS injections. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
        <add name="X-XSS-Protection" value="1; mode=block" />
        <!-- Protects against Clickjacking attacks. ref.: http://stackoverflow.com/a/22105445/1233379 -->
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <!-- Protects against MIME-type confusion attack. ref.: https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-headers/ -->
        <add name="X-Content-Type-Options" value="nosniff" />
        <!-- Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet -->
        <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
        <!-- CSP modern XSS directive-based defence, used since 2014. ref.: http://content-security-policy.com/ -->
        <add name="Content-Security-Policy" value="default-src 'self'; connect-src *; font-src * data:; frame-src *; img-src * data:; media-src *; object-src *; script-src * 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline';" />
        <!-- Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ -->
        <add name="Referrer-Policy" value="same-origin" />
        <!--Feature-Policy is a new header that allows a site to control which features and APIs can be used in the browser. ref.: https://wicg.github.io/feature-policy/ -->
        <add name="Feature-Policy" value="accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment *; usb 'none'" />
<!--ProjectGuid: 4f1f649c-1020-45be-a487-f416d9297ff3-->

Based on the error it looks like for some reason ASP.NET is looking for a web.config file in my wwwroot directory. Anyone able to provide any guidance on what I might be doing wrong?


Nearly as soon as I post the question I find the answer.

For anyone who runs into this issue the problem was that somehow I had mapped a virtual directory into this path for this application.

Once I removed this everything worked as expected.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.