We are serving up files for our own application for download from web servers, including IIS. One such file has the .config extension. Turns out that IIS won't serve this because it thinks it's a config file of its own. I'm thinking of using just .configuration instead. Will this be OK? Is there a list of 'forbidden' extensions for serving from IIS?

2 Answers 2


Yes there is a list of extensions to block called Request Filtering, you can run: appcmd list config -section:system.webServer/security/requestFiltering you will see something like: ... ...

in my Windows 7 machine the list includes:
.asa,.asax,.ascx,.master,.skin,.browser,.sitemap, .config,.cs,
.csproj,.vb,.vbproj,.webinfo,.licx,.resx, .resources,.mdb,.vjsproj,
.java,.jsl,.ldb,.dsdgm,.ssdgm, .lsad,.ssmap,.cd,.dsprototype,
.lsaprototype,.sdm, .sdmDocument,.mdf,.ldf,.ad,.dd,.ldd,.sd,
.adprototype, .lddprototype,.exclude,.refresh,.compiled,.msgx,.vsdisco

Note that you can also within your application specify more extensions or allow other extensions that might not otherwise be allowed by using a web.config inside your folder.

Warning do not do this since .config files could include sensitive information.

For example, if you drop a web.config inside your application with the following contents it will let users download .config files:

<?xml version="1.0" encoding="UTF-8"?>
                    <remove fileExtension=".config" />

For more info see: http://www.iis.net/configReference/system.webServer/security/requestFiltering

Finally, if you are going to use some random extension, you need to make sure that IIS also knows what mime type to use and know the extension that you will use if you want to allow static file downloads, and that needs to be inside the staticContent section (appcmd list config -section:system.webServer/staticContent). You can also configure this inside web.config just as above.

  • Thanks. We don't have access to customer servers (either for investigation or to change config). I'm looking for a blacklist of extensions which would be a bad idea on standard deployments. As far as I can tell from that page, it's only .config extension should be avoided. Correct?
    – Joe
    Jul 23, 2010 at 15:22
  • no, the list is actually larger, in my Windows 7 machine I have: .asa,.asax,.ascx,.master,.skin,.browser,.sitemap, .config,.cs,.csproj,.vb,.vbproj,.webinfo,.licx,.resx, .resources,.mdb,.vjsproj,.java,.jsl,.ldb,.dsdgm,.ssdgm, .lsad,.ssmap,.cd,.dsprototype,.lsaprototype,.sdm, .sdmDocument,.mdf,.ldf,.ad,.dd,.ldd,.sd,.adprototype, .lddprototype,.exclude,.refresh,.compiled,.msgx,.vsdisco Jul 24, 2010 at 0:49
  • @Joe - I've added the list to this answer. Jul 24, 2010 at 14:40

You could just .zip all your files then you can server any extension you would like.

  • That's not an option, sorry.
    – Joe
    Jul 23, 2010 at 14:27
  • figured I would check Jul 23, 2010 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.