I have an ASP.NET MVC website. There is a "booklist.csv" file in the "~/booklist" folder, which is not supposed to be served to the public.
To prevent the public from downloading this file using
www.mywebsite.com/booklist/booklist.csv
I have the following web.config file in the "~/booklist" folder:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
I have also the following in the root web.config:
<modules runAllManagedModulesForAllRequests="true">
On our test server, it works, and public cannot download that "booklist.csv" file. But on our production server, it doesn't work. Public can still directly download that CSV file.
What could be the problem?
I worked out. The production server was actually behaving as expected, the same as the testing server. It was my browser caching that CSV file. So my settings were correct.
Related
I have this in the web.config
<location path="SomeDir/SomeSubDir">
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>
How do I change this so that this rule only applies when the app is not running on localhost? Is there a way to make the rule detect the environment?
I would remove the deny from the web.config and use something like this in the page load event.
if(!HttpContext.Current.Request.IsLocal && !User.Identity.IsAuthenticated)
Response.Redirect("Login.aspx");
Config Transformations will give you a Web.Release.config that will transform your Web.Config when you publish with the Release settings.
If you don't already have the transform files, you will need to right-click the Web.config file and then click Add Config Transforms.
Here is the MSDN How to: Transform Web.config When Deploying a Web Application Project.
Your Web.Release.config file would look something like this:
<configuration xmlns:xdt="...">
<location xdt:Locator="Match(path)" xdt:Transform="Remove" />
</configuration>
Which will result in that location element being removed when you do a Release publish.
Under the root directory I have the following structure
..
..
..
web.config
Report Folder
- Login.aspx
- Web.config
|
|-> ViewReport
|
|-> Report.aspx
In my web.config file in the Report folder I have the following:
<?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="ViewReport/Report.aspx">
<credentials passwordFormat="Clear">
<user name="Johl" password="pass888"/>
</credentials>
</forms>
</authentication>
</system.web>
<location path="ViewReport/Report.aspx">
<system.web>
<authorization>
<allow users="Johl"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
</configuration>
When I start debugging I get the following message:
It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.
NOTE that in my root web.config I have something like the following:
In my root, I already have the following:
<system.web>
<authentication mode="Forms">
<forms loginUrl="Str/StrUserLogin.aspx" timeout="2880" slidingExpiration="true" />
</authentication>
<authorization>
<allow users="*" />
</authorization>
</system.web>
Create a virtual directory at the site root. This can be done via project properties in VS under the Web tab.
It's also possible that you have things defined in the sub-directory that should be in the root config file. See similar question here:
Error to use a section registered as allowDefinition='MachineToApplication' beyond application level
Converting your folder/project into an application in IIS can resolved this error.
This error seems to occur if you try to open an asp.net WEBSITE and run it while it was originally encapsulated by a SOLUTION.
Do this: Close the website, find the related solution (.sln-file) further up in the file system and open this in stead. Inside the solution you will now be able to use your website without getting this error.
It would be nice if Microsoft could guide people in the right direction when they get lost in asp.net like this. The present error message about allowDefinition=MachineToApplication is not understandable for normal humans like me.
If you put the published files in inetpub/wwwroot/../ Make sure to add the root folder as an application in IIS Manager.
The contents of the web.config in the subdirectory should be placede in the root directory. The configuration in the subdirectory is making IIS treat the subdirectory as the application root but it is not the application root. This is why you get the error allowDefinition='MachineToApplication'.
I deleted my bin and obj folder for the project and then rebuilt the solution and everything was working fine...not a technically savvy answer but it works.
Just add this below lines in your csproject file to clean up the obj/bin folder automatically.
<Target Name="BeforeBuild">
<!-- Remove obj folder -->
<RemoveDir Directories="$(BaseIntermediateOutputPath)" />
<!-- Remove bin folder -->
<RemoveDir Directories="$(BaseOutputPath)" />
</Target>
I opened the web site from IIS instead of file system and it worked.
In my case, my website was working before deploying the new version.
I found an incorrect Web.config inside Views folder. I replaced it with original file and the problem resolved.
This error occur if your web.config file and your all aspx file are not in the same folder. so please put all the files in the same folder.
Thanks.
I have an ASP.NET 2.0 application running on IIS6 (windows swrver 2003) and have successfully used the method described in this article: http://bit.ly/i78O7w to secure .jpg, .doc & .xls files in a directory named 'upload'.
I have now added .docx files to the directory but the browser returns a 404 when a docx is requested. The security still works.
Do I need to to make changes in web.config or in the Application Configuaration in IIS6?
web.config snippet:
<location path="upload">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
turns out I was missing the obvoious which was that I had to add the mime types for office 2007 to IIs6. Nothing to do with asp.net
My WebSite runs fine on iis6, as you can see here: http://93.115.250.xxx/
I recently tried to migrate it to iis7, and after a lot of hussle I now can see the starting page, but all urls rewritten through mappageroute give a 404 as you can see here: 94.75.xxx.xxx
Any ideas as to why iis7 is trying to access a physical file and ignores the pageroute?
I am currently programming in a mixed environment. My alpha server is Server2008, beta and production are still 2003. You need to modify the config file to have system.webServer node with the following entry:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
I am not sure if this is applicable in your instance, but my application required log-in accept for publicly available image files available from a re-written directory. Don't forget to add an except to where the route is mapped:
<location path="{target path}">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
Context:
IIS 6 on Windows 2003 Server
ASP.NET 3.5 sp1
C# Web Application running from a virtual directory
There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
OR
<httpHandlers>
...
<add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>
The logs in a different directory can be protected through another Web.config file:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:
<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />
How do I make IIS 6 respect the authorization rules in Web.config.
Note: assume that I can't move these files outside of the deployment directory.
It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.
To work around this, I had to do the following (from this forum post):
From IIS Console, open properties of the virtual directory of my app.
Virtual Directory > Configuration
Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
All verbs. Uncheck both "Script engine" and "Verify that file exists".
Is there any way to do this from within Web.config?
Try this:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.
To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:
1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)
2) in web.config add the location for the restricted directory or file
<location path="directory_or_file_name">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
3) Add the following to the httpHandlers section:
<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />
This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.
URL Authorization: The URLAuthorizationModule class is
responsible for URL authorization on
Windows 2003. This mechanism uses the
URL namespace to store user details
and access roles. The URL
authorization is available for use at
any time. You store authorization
information in a special XML file in a
directory. The file contains tags to
allow or deny access to the directory
for specific users or groups. Unless
specified, the tags also apply to
subdirectories.
You need to do the following:
<deny users="?"/>
<deny users="*"/>
The wild card entry "?" means that no one else will be able to gain access to this directory.