0

I have an image folder that I want accessible even without login. To achieve that I'm trying to remove the http module checking login with a child Web.config in my image folder. However, neither clear nor remove seems to have an effect. Am I missing something?

Parent Web.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.web>
    <compilation debug="true" targetFramework="4.7.2" />
    <httpRuntime targetFramework="4.7.2" />
  </system.web>
  <system.codedom>
    <compilers>
      <compiler language="c#;cs;csharp" extension=".cs" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=2.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:default /nowarn:1659;1699;1701" />
      <compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=2.0.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" warningLevel="4" compilerOptions="/langversion:default /nowarn:41008 /define:_MYTYPE=\&quot;Web\&quot; /optionInfer+" />
    </compilers>
  </system.codedom>

    <system.webServer>
        <modules>
            <add name="notfound" type="HttpModulesRemove.Modules.NotFoundModule, HttpModulesRemove"/>
        </modules>
    </system.webServer>
</configuration>

Child Web.config in images folder

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.webServer>
        <modules>
            <clear />
            <remove name="notfound"/>
        </modules>
    </system.webServer>
</configuration>

NotFoundModule.cs, module used for the example. Returns 404 on all requests.

using System;
using System.Web;

namespace HttpModulesRemove.Modules
{
    public class NotFoundModule : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.BeginRequest += OnBeginRequest;
        }

        private void OnBeginRequest(object sender, EventArgs e)
        {
            var application = (HttpApplication)sender;
            var context = application.Context;

            context.Response.StatusCode = 404;
            context.Response.Flush(); // Sends all currently buffered output to the client.
            context.Response.SuppressContent = true;  // Gets or sets a value indicating whether to send HTTP content to the client.
            application.CompleteRequest(); // Causes ASP.NET to bypass all events and filtering in the HTTP pipeline chain of execution and directly execute the EndRequest event.
        }

        public void Dispose()
        {

        }
    }
}

With this setup, shouldn't I be able to access the files in the image folder with the child config clearing out the module?

Simme Nilsson
  • 143
  • 1
  • 10
  • While `` may work for some configuration sections, some require the `` directive, and others don't seem to support it either. In these cases, try setting `inheritInChildApplications="false"`. For more information please refer to this thread: https://stackoverflow.com/questions/782252/avoid-web-config-inheritance-in-child-web-application-using-inheritinchildapplic – YurongDai Oct 10 '22 at 06:11
  • Trying various approaches using location. Some seems to work in inetmgr if I check modules list for the subfolder, but when actually accessing the file I still hit the module I removed. – Simme Nilsson Oct 10 '22 at 07:22
  • If you remove the module in the parent web.config, can you successfully access the files in the image folder? – YurongDai Oct 11 '22 at 02:49
  • Yes, if I don't have my module, then file can be browsed to. – Simme Nilsson Oct 17 '22 at 07:47
  • Does your image folder have enough access rights? Add IUSR to the folder with Read privileges. – YurongDai Oct 18 '22 at 08:19

0 Answers0