Can I use wildcards in the web.config location path attribute?

Question

In IIS 7 I try to deny access to all files with the extension .xml for all users.

I tried the following setting in my web.config file:

<location path="*.xml">
    <system.web>
      <authorization>
        <deny users="*"/>
      </authorization>
    </system.web>
</location>

But then getting any file results in an internal server error.

It works if I deny access to the individual files but this solution does not buy me much as I do not know all .xml files in advance.

Possible duplicate of [Web.config: Wildcards in location and authorization](http://stackoverflow.com/questions/4375208/web-config-wildcards-in-location-and-authorization) — Michael Freidgeim, Mar 30 '17 at 06:34

score 10 · Accepted Answer · edited May 23 '17 at 12:10

10

Try this:

<configuration>
    <system.web>
        <httpHandlers>
            <add path="*.xml" verb="*" 
             type="System.Web.HttpNotFoundHandler" />
        </httpHandlers>
    </system.web>
</configuration>

By the way you could alternatively store all of your xml files within the App_Data directory. Storing files of any type in this directory will not be served to the web.

edited May 23 '17 at 12:10

Community

1
1

answered Oct 27 '09 at 15:17

David Glass

2,334
1
25
35

Can this same approach be applied here: https://stackoverflow.com/questions/47096577/servicestack-api-documentation-in-swagger-ui-behind-the-closed-doors ? – ShP Nov 03 '17 at 15:47

score 5 · Answer 2 · answered Nov 06 '09 at 19:59

5

Another way is to use a request filter:

<system.webServer>
  <security>
    <requestFiltering>
      <fileExtensions>
        <add fileExtension=".xml" allowed="false" />
      </fileExtensions>
    </requestFiltering>
  </security>
</system.webServer>

answered Nov 06 '09 at 19:59

Alexander Egger

5,132
1
28
42

score 0 · Answer 3 · answered Oct 14 '20 at 06:20

I have stumbled across this when searching for a way to change the security applied to all actions within a controller in a legacy application (ASP.NET MVC). I thought I need some sort of wildcard, but simply providing the path including the controller segment is enough:

This allows anonymous access to all actions within FooController.

Can I use wildcards in the web.config location path attribute?

3 Answers3

Linked