I host an application which has a reporting component based on Crystal Reports and I don't have the ability to modify the application or its settings.

The reports are normally rendered as HTML but the user also has the ability to download the report source as an RPT file and this is the part I need to prevent from happening.

The application runs on IIS 7.5 and I am able to prevent the serving of RPT files via the IIS Request Filtering. I tested and when an .RPT file is requested directly the server returns a 404 error which is fine.

However, the application serves the RPT file as an attachment and here is where the IIS request filtering fails for some reason I don't understand.

This is the Entity part of the response that I need to put a block on:

Content-disposition: attachment; filename=CrystalReportViewer1.rpt
Content-Type: application/x-rpt

Is there a way to force the server to return a 404 error when the response has Content-disposition and Content-Type are set to the above values?

  • How does the application serve these attachments? Some handler (.ashx) or a special url? Have you tried Wireshark to diagnose the network traffic? – Peter Ivan Feb 25 '13 at 23:28
  • I have used Fiddler - this is how I got the response headers above. The attachment is served via the same .aspx page which displays the report as an HTML. When the user selects the export option then the same .aspx page responds by serving the.RPT file as an attachment and this is the part I need to block. – Visualizer Feb 27 '13 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.