Two Web.Config files in default MVC project

Question

I was exploring the source of the default MVC 5 projects and found that there are two Web.Config files created. One is in the root of the project and the other in the root of Views. Why are there two?

Answer 1

The web.config file exists in the Views folders to prevent access to your views by any means other than your controller. In the MVC design pattern, controllers are supposed to route requests and return a rendered view to the calling client. In other words, your view at www.mydomain.com/MySuperController/AwesomeAction1/SweetPage.aspx should not be directly accessible.

What does the Web.Config file do in the views folder of a MVC project

Answer 2

All configuration files in IIS are hierarchical. You can have one in every directory, if you want to, and each lower-level configuration overrides the higher level ones.

In the machine-level configuration there are definitions for what each of the sections mean and which web.config files those sections can appear in, which builds up a pretty complex system of settings that can be changed at each level. See, for example, this article on Working with Configuration Files in IIS 7, in particular the section Configuration Levels

In the case of an MVC application, the top-level configuration file defines the web server and web application settings that apply to your entire project. The web.config file that's in your Views folder overrides those settings, where needed, and adds additional settings that only apply to the actual Razor views in your project, and not (say) the App_Data folder or your Global.asax. For example, the web.config for your views adds an additional assembly reference that adds an XML tag for the MVC namespace, which only makes sense in the context of an HTML page:

<add assembly="System.Web.Mvc, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" namespace="System.Web.Mvc" tagPrefix="mvc" />