0

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting and having its settings overridden by the global IIS config in applicationHost.config

I would like to place something along the lines of the following in the System.web section of the sites config file.

<security>
 <requestFiltering>
   <fileExtensions>
     <add fileExtension=".xml" allowed="false" />
   </fileExtensions>
 </requestFiltering>
</security>

This does not seem to work however and you may still access .xml files, also attempting to set Hidden Segments has the same effect.

I have done quote a bit of research to no avail and made some changes to the applicationHost.config of IIS

<section name="requestFiltering" overrideModeDefault="Allow" />

(this was for the correct section group of system.webServer")

I also ran the following command wich just seems to remove all the settings from the applicationHost.config but still has no effect

C:\Windows\System32\inetsrv>appcmd.exe unlock config -section:system.webServer/security/requestFiltering

All the answers i have come across seem to focus on doing the reverse and enabling IIS to serve static files, i would like to do the exact opposite with a server that seems to serve out all files already.

0

So after a lot of searching i eventually created a new site to test the issue on the webserver, this helped me to locate the issue.

The new site did not exhibit the behavior of the problematic one by comparing the different site setups in the applicationHost.config I tracked down the following setting under the applicationPools

<add name="WebsiteNameRemoved" autoStart="true" enableConfigurationOverride="false" managedPipelineMode="Integrated">
            <processModel identityType="ApplicationPoolIdentity" />
</add>

the soulution is to set enableConfigurationOverride to true (it is by default true so removing it will also work)

so changing it to the following will resolve the issue

<add name="WebsiteNameRemoved" autoStart="true" enableConfigurationOverride="true" managedPipelineMode="Integrated">
            <processModel identityType="ApplicationPoolIdentity" />
</add>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.