Block access to subdirectory using Web.config

I have a subdirectory in my ASP.NET project that contains utility files. They're needed by the code at run time, but I don't want them to be visible over the web.

What is the syntax in a Web.config file to block access to all users to a single subdirectory and all its contents?

IIS 7 has a new "request filtering" feature. You probably want to use the hidden segments configuration:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering>
    <hiddenSegments>
     <add segment="BIN"/>
    </hiddenSegments>
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

This causes http://yoursite/bin to not be servable (but http://yoursite/binary still works)

Check out: http://learn.iis.net/page.aspx/143/how-to-use-request-filtering

Your problem is that if IIS simply returns the files ASP.Net will never get a chance to interfere. I believe it can be done by enabling forms based authentication and considerable messing around, but I would simply move the files outside the wwwroot folder.

Block access to subdirectory using Web.config

Related

Recent Posts