Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

IIs block files web.config

Posted on 2016-10-04
6
Medium Priority
?
220 Views
Last Modified: 2016-10-05
Via web.config we entered this to protect all the files:

	    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>

Open in new window


That thing works excellent blocking from all directories the anonymous users and allowing access to logged users but just for files like aspx if we try to access a jpg without login it can be accessed. How can make work that script to block all kind of files?

And we added a virtual a directory outside the webapp but the question here is how can we protect everything there also but configuring from  webapp not the real directory we don't want to protect from the real directory outside the webapp just we want to protect when the user tries to access via the webapp for example webapp/virualdir/pdf.pdf there protect the pdf if user is not logged.
0
Comment
Question by:Alex E.
  • 3
  • 2
6 Comments
 
LVL 9

Expert Comment

by:Karen
ID: 41829309
Delete the
<allow users="*" />
line. You only need

        <authorization>
            <deny users="?" />
        </authorization>
0
 
LVL 29

Expert Comment

by:Dan McFadden
ID: 41829418
Here is a nice article that explains the <authorization> element.

Link:  https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Here is the MSDN reference:  https://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

An IIS Forum thread over issues with Authorization:  https://forums.iis.net/p/1173012/1961218.aspx

Dan
0
 

Author Comment

by:Alex E.
ID: 41829907
I removed:


<allow users="*" />

And we continue looking pdf, jpg files the rest fo the files are protected like aspx

What could be?
0
NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

 
LVL 29

Expert Comment

by:Dan McFadden
ID: 41829921
How is your Application Pool configured?  What is the Managed Pipeline Mode?

Dan
0
 
LVL 29

Accepted Solution

by:
Dan McFadden earned 2000 total points
ID: 41829932
I would also read thru this article, it discusses your issue in detail.

Link:  http://www.4guysfromrolla.com/articles/122408-1.aspx

Dan
0
 

Author Closing Comment

by:Alex E.
ID: 41830340
Thank you
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The article shows the basic steps of integrating an HTML theme template into an ASP.NET MVC project
For anyone that has accidentally used newSID with Server 2008 R2 (like I did) and hasn't been able to get the server running again because you were unlucky (as I was) and had no backups - I was able to get things working by doing a Registry Hive rec…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

927 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question