3

I have a directory, "d:/resources/xxxxx/file-name.xxx" that stores the file types: .png, .xml, .pdf, which are accessed by a website. A virtual directory is set up in IIS, "resources," which points to this hard drive location, to allow the .png images to be accessed through an http request, but I am referencing the .pdf and .xml files by their hard drive location. These files are part of a workflow process so they must all remain in their current directory structure.

IIS needs to be allowed to serve the .png images, but I do not want it to be allowed to serve the .pdf or .xml files, for security purposes.

I tried setting up an http handler, which would have worked fine, but I can't make the path specific enough. If I set it to "/resources/*", then I need to manually output the allowed file types and that was getting a bit wonky. I can't set the path to "*.pdf" because other directories should be allowed to have their .pdf files accessed.

I'm just looking for a straight forward way to restrict access if someone tries to go to "www.mysite.com/resources/dir/mypdf.pdf," or ".../myxml.xml," but still allow .png and all other potential file types to be served.

Also, please let me know if I am going about this all the wrong way.

StronglyTyped
  • 2,134
  • 5
  • 28
  • 48

2 Answers2

4

Try adding this before your closing tag for configuration and see how it does:

<location path="/resources">
    <system.webServer>
        <handlers>
            <add name="PdfForbiddenHandler" path="*.pdf" verb="*" type="System.Web.HttpForbiddenHandler" resourceType="File" preCondition="integratedMode" />
            <add name="XmlForbiddenHandler" path="*.xml" verb="*" type="System.Web.HttpForbiddenHandler" resourceType="File" preCondition="integratedMode" />
        </handlers>
    </system.webServer>
 </location>
rene
  • 41,474
  • 78
  • 114
  • 152
JamieSee
  • 12,696
  • 2
  • 31
  • 47
1

To use the IIS (7.x, classic mode) Manager UI:

  1. Expand your site and select the "resources" directory.
  2. In Features View, double-click Handler Mappings.
  3. In the grid, find the module mapping named 'StaticFile', double-click this item;
  4. Enter the file name extension that are allowed e.g. *.png, *.gif etc.
  5. Click OK.

enter image description here

Kibria
  • 1,865
  • 1
  • 15
  • 17