1

How can i prevent users from getting the list of files that exist in my website?

For example when users type on the address bar the WebsiteAddress+/DirectoryToSearch/ they get the list of files in that directory, without getting any permission denied error

Is there any setting in asp.net that am i missing?

OrElse
  • 9,709
  • 39
  • 140
  • 253

1 Answers1

2

You should disable directory browsing in IIS.

For IIS7: http://technet.microsoft.com/en-us/library/cc731109%28WS.10%29.aspx

For IIS6: Open the web site's properties in IIS Manager, and under the tab "Home Directory", uncheck the checkbox labeled "Directory Browsing".

John Rasch
  • 62,489
  • 19
  • 106
  • 139
  • I just did, and it rocks! But why the default setting was ON? Just curious – OrElse Jan 17 '10 at 23:21
  • @strakastroukas - usually the default is disabled, you may have mis-clicked when creating the site in IIS Manager, I know I've done that before! – John Rasch Jan 17 '10 at 23:24
  • NOPE! This one is pasted as is In the IIS tools. Note: - Default setting is ON - Entire site will inherit this setting Should i contact the hosting company or what? – OrElse Jan 17 '10 at 23:29