I have an ASP.NET 2.0 application running on IIS6 (windows swrver 2003) and have successfully used the method described in this article: http://bit.ly/i78O7w to secure .jpg, .doc & .xls files in a directory named 'upload'.
I have now added .docx files to the directory but the browser returns a 404 when a docx is requested. The security still works.
Do I need to to make changes in web.config or in the Application Configuaration in IIS6?
web.config snippet:
<location path="upload">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
turns out I was missing the obvoious which was that I had to add the mime types for office 2007 to IIs6. Nothing to do with asp.net
Related
I have an ASP.NET MVC website. There is a "booklist.csv" file in the "~/booklist" folder, which is not supposed to be served to the public.
To prevent the public from downloading this file using
www.mywebsite.com/booklist/booklist.csv
I have the following web.config file in the "~/booklist" folder:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
I have also the following in the root web.config:
<modules runAllManagedModulesForAllRequests="true">
On our test server, it works, and public cannot download that "booklist.csv" file. But on our production server, it doesn't work. Public can still directly download that CSV file.
What could be the problem?
I worked out. The production server was actually behaving as expected, the same as the testing server. It was my browser caching that CSV file. So my settings were correct.
I have an ASP.NET MVC app and some folder that contains a lot of images. This directory is located outside my app folder. And I want to use images from this directory in my app in web pages without copying them to app directory. I created virtual directory for my application in IIS and called it MyOuterDir. It references to outer images directory. Then I wrote in my web page something like this :
<img src='/MyOuterDir/some.png' />
But it doesn't work, I faced with error 404:
GET http://localhost:85/MyOuterDir/some.png 404 (Not Found)
Where am I wrong? How to make IIS (or browser) properly read images from virtual directory?
P.S. It doesn't work even I change reference to folder located in app directory
I would check your web.config file, make sure you have permission for the file system.
<location path="Folder/Logs">
<system.web>
<authorization>
<allow roles="Admin" />
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="OtherFolder/Dump">
<system.web>
<authorization>
<allow users="*" />
<deny users="?" />
</authorization>
</system.web>
</location>
If you don't have permission you won't be able to find the file/Image
Try this way:
<img src='MyOuterDir/some.png' />
Good Luck!
I have an asp.net/c# website. I don't want users reach www.example.com/uploads folder like :
I tried this in web.config :
<location path="uploads">
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
But it forbids all the files under uploads folder.Users can reach the files but I don't want users see the list of that files. What should I do about this?
I have a directory where I am placing PDF files that are generated by my application. The issue is that since there are no aspx pages, the security in the web.config is not preventing direct navigation to those pdf's. Granted, the information is public, I just dont want someone to be able to go straight to them for a variety of reasons.
So the question is, how do I prevent access to that directory in a web.config file? here is what I have:
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<authorization>
<allow roles="role1" />
<allow roles="role2" />
<allow roles="role3" />
<allow roles="role4" />
<deny users="*" />
</authorization>
</system.web>
You should be using an HttpHandler to accomplish file security you can map extensions through IIS and use these to handle mappings of each particular file type (ie: pdf, doc, exe, etc...)
Here is a link describing it...
http://www.15seconds.com/Issue/020417.htm
Context:
IIS 6 on Windows 2003 Server
ASP.NET 3.5 sp1
C# Web Application running from a virtual directory
There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
OR
<httpHandlers>
...
<add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>
The logs in a different directory can be protected through another Web.config file:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:
<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />
How do I make IIS 6 respect the authorization rules in Web.config.
Note: assume that I can't move these files outside of the deployment directory.
It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.
To work around this, I had to do the following (from this forum post):
From IIS Console, open properties of the virtual directory of my app.
Virtual Directory > Configuration
Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
All verbs. Uncheck both "Script engine" and "Verify that file exists".
Is there any way to do this from within Web.config?
Try this:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.
To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:
1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)
2) in web.config add the location for the restricted directory or file
<location path="directory_or_file_name">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
3) Add the following to the httpHandlers section:
<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />
This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.
URL Authorization: The URLAuthorizationModule class is
responsible for URL authorization on
Windows 2003. This mechanism uses the
URL namespace to store user details
and access roles. The URL
authorization is available for use at
any time. You store authorization
information in a special XML file in a
directory. The file contains tags to
allow or deny access to the directory
for specific users or groups. Unless
specified, the tags also apply to
subdirectories.
You need to do the following:
<deny users="?"/>
<deny users="*"/>
The wild card entry "?" means that no one else will be able to gain access to this directory.