What file extensions must be allowed in request filtering when using ASP.Net MVC 3?

Solution 1:

Try just "." as the file extension. This seems to work on a Windows 2008 R2 SP1 box with ASP.NET 4.

I haven't seen this documented anywhere, but it follows the same rule as the Handler Mappings for extensionless URLs that were introduced in ASP.NET 4 / W2K8 R2 SP1 (see Meaning of path attribute on handlers in web.config question).

Solution 2:

I think what you're trying to do is not possible.

MVC doesn't use file extensions. By setting "Allow unlisted file name extensions" to false, you limit IIS to just serve the extensions listed. As you can't add an 'extensionless extension' IIS denies the request.

In other words, you need "Allow unlisted file name extensions" set to true if you want to use MVC.

You don't have to allow '.cshtml' you can even deny access to it, MVC still works, because the view files are not served directly by IIS by read by MVC and then send via IIS to the client.