Solved

IIs block files web.config

Posted on 2016-10-04
6
125 Views
Last Modified: 2016-10-05
Via web.config we entered this to protect all the files:

	    <authorization>
      <deny users="?" />
      <allow users="*" />
    </authorization>

Open in new window


That thing works excellent blocking from all directories the anonymous users and allowing access to logged users but just for files like aspx if we try to access a jpg without login it can be accessed. How can make work that script to block all kind of files?

And we added a virtual a directory outside the webapp but the question here is how can we protect everything there also but configuring from  webapp not the real directory we don't want to protect from the real directory outside the webapp just we want to protect when the user tries to access via the webapp for example webapp/virualdir/pdf.pdf there protect the pdf if user is not logged.
0
Comment
Question by:Alex E.
  • 3
  • 2
6 Comments
 
LVL 9

Expert Comment

by:Karen
ID: 41829309
Delete the
<allow users="*" />
line. You only need

        <authorization>
            <deny users="?" />
        </authorization>
0
 
LVL 27

Expert Comment

by:Dan McFadden
ID: 41829418
Here is a nice article that explains the <authorization> element.

Link:  https://weblogs.asp.net/gurusarkar/setting-authorization-rules-for-a-particular-page-or-folder-in-web-config

Here is the MSDN reference:  https://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

An IIS Forum thread over issues with Authorization:  https://forums.iis.net/p/1173012/1961218.aspx

Dan
0
 

Author Comment

by:Alex E.
ID: 41829907
I removed:


<allow users="*" />

And we continue looking pdf, jpg files the rest fo the files are protected like aspx

What could be?
0
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

 
LVL 27

Expert Comment

by:Dan McFadden
ID: 41829921
How is your Application Pool configured?  What is the Managed Pipeline Mode?

Dan
0
 
LVL 27

Accepted Solution

by:
Dan McFadden earned 500 total points
ID: 41829932
I would also read thru this article, it discusses your issue in detail.

Link:  http://www.4guysfromrolla.com/articles/122408-1.aspx

Dan
0
 

Author Closing Comment

by:Alex E.
ID: 41830340
Thank you
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
FTP Directory Permissions 3 28
Problem to setup GUI 11 33
XenApp 6.5 License Server Migration 3 11
MailAddress in vb 4 17
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question