168

When creating a new ASP.NET application in Visual Studio, a couple of files and folders are created automatically. One of those folders is called App_Data.

Also when publishing a website by selecting the menu option Build->Publish a checkbox is available Include files from the App_Data folder.

Am I right assuming that the files put in this file and its sub-folders are not going to be accessible through the web? For example, would it be safe to put in that folder resources that I only intend to be used by the application code?

What is the real intended use of the App_Data folder?

EDIT:

Thank you for all the answers. From the answers received so far I am interested mostly in two points mentioned:

  1. App_Data is essentially a storage point for file-based data store
  2. It should not be viewable by the web and is a place for the web app to store and read data from

Would someone be able specify how the "not viewable by the web" is ensured? Can I rely on that fact when performing standard deployment, or do I need to check some IIS settings on the server as well.

In the situation when I have a set of pdf files that I want to be accessible only from the application. Would App_Data folder be the right place to use, or should I create a separate folder and manually set IIS to ensure that it is not accessible by Web?

Community
  • 1
  • 1
padn
  • 1,959
  • 4
  • 16
  • 15

9 Answers9

128

App_Data is essentially a storage point for file-based data stores (as opposed to a SQL server database store for example). Some simple sites make use of it for content stored as XML for example, typically where hosting charges for a DB are expensive.

annakata
  • 74,572
  • 17
  • 113
  • 180
  • 9
    Thanks annakata for this answer. I think the important point to add is that the content of App_Data is by default not viewable by the web as mentioned by JaredPar. and also as you commented "this behaviour can be modified from *.config httphandlers" – padn Feb 10 '09 at 10:08
  • Does app_data folder contain the references to local web services? My web application works fine in .net F5 run. But web services don't work after packaging and deploying in ISS... :( – bonCodigo Sep 01 '14 at 08:06
  • 1
    Also this folder is used for storing a local database files. – Andrei Khotko May 09 '17 at 10:14
  • 2
    One thing that hasen't been mentioned is that IIS reboots the web process when a file is changed, but App_Data is excluded from this! – Peter Jun 04 '20 at 09:16
47

in IIS, highlight the machine, double-click "Request Filtering", open the "Hidden Segments" tab. "App_Data" is listed there as a restricted folder. Yes i know this thread is really old, but this is still applicable.

rocketsarefast
  • 4,072
  • 1
  • 24
  • 18
26

The intended use of App_data is to store application data for the web process to acess. It should not be viewable by the web and is a place for the web app to store and read data from.

JaredPar
  • 733,204
  • 149
  • 1,241
  • 1,454
  • 7
    Not just "should not", anything in that folder is blocked from being served by ASP.NET – John Sheehan Feb 09 '09 at 16:34
  • @John, I was under the impression there were ways to "change" that behavior. Yes, definately evil to do so but I don't know how common or not that is – JaredPar Feb 09 '09 at 16:43
  • How is that "not viewable" achived? Would the App_data folder have a specific settings in IIS? – padn Feb 09 '09 at 17:16
  • @padn, I'm not 100% sure about the stack but it is either special cased in IIS or the Asp.Net stack. http://msdn.microsoft.com/en-us/library/ex526337.aspx – JaredPar Feb 09 '09 at 17:23
  • 2
    iirc this behaviour can be modified from *.config httphandlers – annakata Feb 10 '09 at 08:40
16

It's a place to put an embedded database, such as Sql Server Express, Access, or SQLite.

Shawn
  • 19,465
  • 20
  • 98
  • 152
  • 1
    Or any other data the site might use like, for example, XML files (like a list of states/countries/etc) – John Sheehan Feb 09 '09 at 16:35
  • 1
    Is is a the database only then? Can I put say some e.g. pdf files in it which I want to access thought the code only, e.g using Response.TransmitFile method? – padn Feb 09 '09 at 16:37
  • 5
    anything - the concept of data doesn't specify a filetype or format – annakata Feb 09 '09 at 16:40
13

The App_Data folder is a folder, which your asp.net worker process has files sytem rights too, but isn't published through the web server.

For example we use it to update a local CSV of a contact us form. If the preferred method of emails fails or any querying of the data source is required, the App_Data files are there.

It's not ideal, but it it's a good fall-back.

Ed Blackburn
  • 551
  • 1
  • 4
  • 11
10

From the documentation about ASP.NET Web Project Folder Structure in MSDN:

You can keep your Web project's files in any folder structure that is convenient for your application. To make it easier to work with your application, ASP.NET reserves certain file and folder names that you can use for specific types of content.

App_Data contains application data files including .mdf database files, XML files, and other data store files. The App_Data folder is used by ASP.NET to store an application's local database, such as the database for maintaining membership and role information. For more information, see Introduction to Membership and Understanding Role Management.

Martin Brown
  • 24,692
  • 14
  • 77
  • 122
eKek0
  • 23,005
  • 25
  • 91
  • 119
7

The main intention is for keeping your application's database file(s) in.

And no this will not be accessable from the web by default.

Martin Brown
  • 24,692
  • 14
  • 77
  • 122
7

We use it as a temporary storage area for uploaded csv files. Once uploaded, an ajax method processes and deletes the file.

gumps
  • 71
  • 1
  • 1
6

The intended use for App_Data is to store database related file. Usually SQL Server Express .mdf files.

GEOCHET
  • 21,119
  • 15
  • 74
  • 98
WebMatrix
  • 1,561
  • 3
  • 12
  • 17