How to restrict static files to access from browser

Question

0.00/5 (No votes)

See more:

Hi all,
I have been struggling to restrict static files to download from browsers. But not able to restrict. I know that the following code should work but not working.
This is the root web.config file code.

XML

Copy Code

<location path="Templates">
  <system.web>
    <authorization>
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

I have some documents and excel files available at Templates folder in root folder. I want to restrict the files for all users.

Could any one please help on this?

What I have tried:

I have used the following code in both root web.config file and Templates folder web.config file.

XML

Copy Code

<location path="Templates">
  <system.web>
    <authorization>
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

Posted 21-Feb-16 22:07pm

Kumarbs

Updated 15-Mar-22 8:26am

v2

Add a Solution

2 solutions

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Kornfeld Eliyahu Peter · Answer 1 · 2016-02-22T01:31:00

Solution 1

The problem is that ASP.NET runtime do not involved (by default) when serving static content, like files from your folder...
If the runtime not involved, than no-one will check what written in the web.config file...
You have several options:
1. Map relevant file types to the ASP.NET engine
2. Write custom handler to server (r deny in your case) those files
3. Use the integrated pipeline in IIS 7 to make all requests invoke ASP.NET runtime...

Understanding IIS 7.0 URL Authorization : The Official Microsoft IIS Site[^]

Permalink

Posted 22-Feb-16 1:31am

Kornfeld Eliyahu Peter

Comments

Kumarbs 23-Feb-16 0:03am

Thank you for your solution. The following code fixed my problem.
<system.webserver>
<modules>
<remove name="UrlAuthorization">
<add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule">
</add></remove></modules>
</system.webserver>

I have gone through Microsoft support site "https://support.microsoft.com/en-us/kb/815152" provided the solution like below

<system.web>
<httphandlers>
<add verb="*" path="*.doc" type="System.Web.HttpForbiddenHandler">
</add></httphandlers>
</system.web>

But this doesn't solve my problem. Could you have your thoughts on this?

Kornfeld Eliyahu Peter 23-Feb-16 2:43am

That solution didn't solved your problem, because a direct link to the file (doc) does not use the web.config at all unless you use the URL authorization, as you did...

Kumarbs 23-Feb-16 3:56am

Thank you very much for your inputs.
Again, In what scenario ForbiddenHandlers will be helpful.

Kumar Lachhani · Answer 2 · 2022-03-15T08:26:00

You can restrict the folder with hiddenSegments introduced in IIS 7.0. You need to put the <security> under <system.webserver> in web.config.

Copy Code

<security>
      <requestFiltering>
        <hiddenSegments>
          <add segment="folderName" />
        </hiddenSegments>
      </requestFiltering>
</security>

How to restrict static files to access from browser

2 solutions

Solution 1

Solution 3

Add your solution here

Preview 0

How to restrict static files to access from browser

2 solutions

Solution 1

Solution 3

Add your solution here

Preview 0

Existing Members

...or Join us