Remove unrecognised staticContent mimeMap entries

Question

On a default installation of IIS there are approximately 350 <mimeMap /> elements specified in the <staticContent> section. Some file extensions seem alien to me e.g. .sv4cpio, .cpio, .onetoc2.

I was wondering if it would be worth removing file extensions that I know I will never be serving? Is there a benefit to doing so?

score 1 · Answer 1 · answered Jun 05 '13 at 04:04

1

Yes, and it's recommended as a defence-in-depth security measure.

If IIS doesn't have an extension defined, the staticfilehandler won't serve it (it'll 404 instead).

answered Jun 05 '13 at 04:04

TristanK

9,073
2
28
39

Could you provide a reference? I don't really see why it would enhance security. – Kevin Brydon Jun 05 '13 at 08:11
IIS' static file handler won't serve file types not on the list. So even if a file gets dropped onto the web server, it won't be servable. – TristanK Aug 05 '13 at 14:12
I meant a reference to the person/company who recommends this measure. – Kevin Brydon Aug 05 '13 at 15:25

Remove unrecognised staticContent mimeMap entries

1 Answers1