Avatar of Alex E.
Alex E.
 asked on

IIs block files web.config

Via web.config we entered this to protect all the files:

	    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>

Open in new window


That thing works excellent blocking from all directories the anonymous users and allowing access to logged users but just for files like aspx if we try to access a jpg without login it can be accessed. How can make work that script to block all kind of files?

And we added a virtual a directory outside the webapp but the question here is how can we protect everything there also but configuring from  webapp not the real directory we don't want to protect from the real directory outside the webapp just we want to protect when the user tries to access via the webapp for example webapp/virualdir/pdf.pdf there protect the pdf if user is not logged.
ASP.NET.NET ProgrammingMicrosoft IIS Web ServerWindows Server 2008

Avatar of undefined
Last Comment
Alex E.

8/22/2022 - Mon
Karen

Delete the
<allow users="*" />
line. You only need

        <authorization>
            <deny users="?" />
        </authorization>
Dan McFadden

Here is a nice article that explains the <authorization> element.

Link:  https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Here is the MSDN reference:  https://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

An IIS Forum thread over issues with Authorization:  https://forums.iis.net/p/1173012/1961218.aspx

Dan
Alex E.

ASKER
I removed:


<allow users="*" />

And we continue looking pdf, jpg files the rest fo the files are protected like aspx

What could be?
Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
Dan McFadden

How is your Application Pool configured?  What is the Managed Pipeline Mode?

Dan
ASKER CERTIFIED SOLUTION
Dan McFadden

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Alex E.

ASKER
Thank you