1

In my application I have script bundles which would bundle scripts and minify them when the site requests for them, I would like to know if it is possible to stop users from accessing the source script instead of the bundled and minified ones? I.E. the user should not be able to do http://mydomain/script.js to access the source script

Steve
  • 11,696
  • 7
  • 43
  • 81
  • FWIW I answered this [on this similar SO post](http://stackoverflow.com/a/21789211/1810243)... can't mark as dupe since no answer was ever accepted... but his main issue was "I dont want anyone getting access to my un-minified scripts by guessing the url". – MikeSmithDev Feb 27 '14 at 15:45
  • @SilverlightFox yea wouldnt hurt to find out how to do it properly – Steve Aug 04 '14 at 19:29

2 Answers2

1

Put your source script files in App_Data.

The App_Data folder is protected from the web by ASP.NET so no one can access http://www.example.com/App_Data/script.js. However, you can still read it locally from the file system.

You may need some modifications to your code to make available the .js file in a different URL path than the source (as they will need to be read from the web from a different path than http://www.example.com/App_Data - e..g http://www.example.com/Scripts)

SilverlightFox
  • 32,436
  • 11
  • 76
  • 145
0

It should be possible to limit access to certain resources and files in the web.config. To deny access to all users to a file, you can add the following:

<configuration>
  ...
  <location path="script.js">
    <system.web>
      <authorization>
        <deny users="*" />
      </authorization>
    </system.web>
  </location>
</configuration>
Jem
  • 4,313
  • 2
  • 18
  • 20
  • Is your script in a folder instead of the root of your site (the same level as your web.config)? I use this across all of my sites to limit access to unauthenticated users (using ). I am also using Forms Authentication, but that shouldn't keep this from working with the deny all * – Jem Feb 28 '14 at 16:18
  • I tried to put the script in root folder and it did not work. I can still request the scripts thru mydomain/script.js. doesn't work if I change the path to "Scripts" which is the folder for scripts too – Steve Feb 28 '14 at 16:31