I host an application which has a reporting component based on Crystal Reports and I don't have the ability to modify the application or its settings.
The reports are normally rendered as HTML but the user also has the ability to download the report source as an RPT file and this is the part I need to prevent from happening.
The application runs on IIS 7.5 and I am able to prevent the serving of RPT files via the IIS Request Filtering. I tested and when an .RPT file is requested directly the server returns a 404 error which is fine.
However, the application serves the RPT file as an attachment and here is where the IIS request filtering fails for some reason I don't understand.
This is the Entity part of the response that I need to put a block on:
Content-disposition: attachment; filename=CrystalReportViewer1.rpt Content-Type: application/x-rpt
Is there a way to force the server to return a 404 error when the response has Content-disposition and Content-Type are set to the above values?