Solved

IIs block files web.config

Posted on 2016-10-04
6
163 Views
Last Modified: 2016-10-05
Via web.config we entered this to protect all the files:

	    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>

Open in new window


That thing works excellent blocking from all directories the anonymous users and allowing access to logged users but just for files like aspx if we try to access a jpg without login it can be accessed. How can make work that script to block all kind of files?

And we added a virtual a directory outside the webapp but the question here is how can we protect everything there also but configuring from  webapp not the real directory we don't want to protect from the real directory outside the webapp just we want to protect when the user tries to access via the webapp for example webapp/virualdir/pdf.pdf there protect the pdf if user is not logged.
0
Comment
Question by:Alex E.
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 9

Expert Comment

by:Karen
ID: 41829309
Delete the
<allow users="*" />
line. You only need

        <authorization>
            <deny users="?" />
        </authorization>
0
 
LVL 28

Expert Comment

by:Dan McFadden
ID: 41829418
Here is a nice article that explains the <authorization> element.

Link:  https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Here is the MSDN reference:  https://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

An IIS Forum thread over issues with Authorization:  https://forums.iis.net/p/1173012/1961218.aspx

Dan
0
 

Author Comment

by:Alex E.
ID: 41829907
I removed:


<allow users="*" />

And we continue looking pdf, jpg files the rest fo the files are protected like aspx

What could be?
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 
LVL 28

Expert Comment

by:Dan McFadden
ID: 41829921
How is your Application Pool configured?  What is the Managed Pipeline Mode?

Dan
0
 
LVL 28

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 41829932
I would also read thru this article, it discusses your issue in detail.

Link:  http://www.4guysfromrolla.com/articles/122408-1.aspx

Dan
0
 

Author Closing Comment

by:Alex E.
ID: 41830340
Thank you
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
SBS 2008 active sync issue 2 51
.NET Core supports which cell phone platforms? 3 35
domain controller shut down question 6 67
SCCM 2012 Queries 2 12
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question