prevent access to static content of asp.net - mvc app

Question

We have asp.net MVC & angular application. We are using identityserver3 for access control to the application. Everything is working as expected, except one thing. Unauthorized users still have access to static content of the application.

Is there any way to deny access to those files before user log in ?

piowtarn · Accepted Answer · 2016-04-01T08:35:47.390

Here is the link to the great post which led me to the solution => Intercepting file requests

Steps I've taken to solve my problem:

Added this line to my webconfig file. This will make sure that js files request wil not be processed by handler.

 <system.webServer>
    <handlers>
       <add name="JSFileHandler" path="*.js" verb="GET"
           type="System.Web.Handlers.TransferRequestHandler"      
           preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>

Register route.

    routes.IgnoreRoute("{resource}.axd/{*pathInfo}");

    routes.RouteExistingFiles = true;
    routes.MapRoute(
        "staticfiles"
        , "{*src}"
        , new { Controller = "Main", action = "GetJS" }
        , new { src = @"(.*?)\.(js)" }                     // URL constraints
    );

Return file from controllers action

public ActionResult GetJS()
{

   var path = this.Url.RouteUrl("staticfiles");
   return File(path,
       System.Net.Mime.MediaTypeNames.Application.Octet,
       Path.GetFileName(path));
}

score 1 · Answer 2 · answered Mar 31 '16 at 13:13

1

You can add this to your web.config

<location path="your/path/tostaticfiles">       
  <system.web>
      <authorization>                
        <deny users="?" /> //Denies unauthorized users
      </authorization>
  </system.web>
</location>

answered Mar 31 '16 at 13:13

andreasnico

1,478
14
23

With form authentications it works like a charm but in this case it does not seems to have any effect. – piowtarn Mar 31 '16 at 13:29
In addition, this will only work for files whose types are mapped to .NET in the IIS handler mappings. jpg files, for instance, are not by default and IIS will serve them up before routing the request to .NET. – esmoore68 Mar 31 '16 at 17:00

score 1 · Answer 3 · answered Dec 01 '17 at 19:36

Apart from the location section you also need to indicate IIS that ASP.NET will process these files (runAllManagedModulesForAllRequests="true").

Next to (sibling of system.web node):

  <location path="Scripts">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
  </location>

Under system.webServer node:

<modules runAllManagedModulesForAllRequests="true">

Note: use users="*" instead of users="?" if you don't want to let any user access your files. In my case I did that to prevent access to my JS files and I serve them using bundles.

prevent access to static content of asp.net - mvc app

3 Answers3

Linked