location path deny does not block in system.web for static folder

Question

What I am trying to deny users to access to static folder:

<location path="log4">
    <system.web>
        <authorization>
           <deny users="*"/>
        </authorization>
    </system.web>
</location>

But this fails.

I found this Q&A for my question:

First answer is solution to my question:

<security>
  <requestFiltering>
    <hiddenSegments>
      <add segment="Uploads"/>
    </hiddenSegments>
  </requestFiltering>
</security>

That's good.

But when I look closer to my web config, I have other sections that may restrict or allow users to access folder such as images or css, but below are not considered for input requests it allows any one access them.

<location path="images">
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</location>
<location path="css">
    <system.web>
        <authorization>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>

In the same thread second most upvoted answer, I would exprect it works but not.

<?xml version="1.0"?>
<configuration>
    <system.web>
        <authorization>
            <allow roles="Administrator"/>
            <deny users="*" />              
        </authorization>
    </system.web>
</configuration>

This might be a solution to my second part of question:

<modules runAllManagedModulesForAllRequests="true"></modules>

However as noted here this cause performance issue.

Here is also mentioned set up handler for example .xml files but I need at folder level.

My question how to deny/allow access to static folder content with location path with out seting runAllManagedModulesForAllRequests to true.

My application works with form authentication and on applicaton pool .net 2.0 with integrated mode.

my requirement deny to static folder content with location path with out setting runAllManagedModulesForAllRequests to true. It seems the point is that there is a "separation" between IIS handling and asp.net handling. — asdf_enel_hak, Apr 09 '19 at 07:44

score 0 · Answer 1 · answered Apr 09 '19 at 07:58

0

You could set deny users in web.config as below:

<location path="s3">
<system.web>
  <authorization>
    <deny users="*" />
  </authorization>
</system.web>

You could also refer below article for more detail:

Setting authorization rules for a particular page or folder in web.config

Regards, Jalpa.

answered Apr 09 '19 at 07:58

Jalpa Panchal

8,251
1
11
26

Thanks for the answer Jalpa, what does it look like your "" part. Apart the configuration in your answer same as in my question, it seems – asdf_enel_hak Apr 09 '19 at 08:04
To restrict access i just use location tag and deny user.I did not set in my web.config file. – Jalpa Panchal Apr 09 '19 at 08:07
Maybe I should create an app scratch and go step by step see where is the problem. Thanks again – asdf_enel_hak Apr 10 '19 at 05:14

location path deny does not block in system.web for static folder

1 Answers1