0

I need to disable my IIS server serving out certain files, i stumbled across Request Filtering but for some reason i cant get it to work on a per site basis. I believe that my website is inheriting and having its settings overridden by the global IIS config in applicationHost.config

I would like to place something along the lines of the following in the System.web section of the sites config file.

<security> <requestFiltering> <fileExtensions> <add fileExtension=".xml" allowed="false" /> </fileExtensions> </requestFiltering> </security>

This does not seem to work however and you may still access .xml files, also attempting to set Hidden Segments has the same effect.

I have done quote a bit of research to no avail and made some changes to the applicationHost.config of IIS

<section name="requestFiltering" overrideModeDefault="Allow" />

(this was for the correct section group of system.webServer")

I also ran the following command wich just seems to remove all the settings from the applicationHost.config but still has no effect

C:\Windows\System32\inetsrv>appcmd.exe unlock config -section:system.webServer/security/requestFiltering

All the answers i have come across seem to focus on doing the reverse and enabling IIS to serve static files, i would like to do the exact opposite with a server that seems to serve out all files already.

Improve this question

1 Answer 1

Reset to default
0

So after a lot of searching i eventually created a new site to test the issue on the webserver, this helped me to locate the issue.

The new site did not exhibit the behavior of the problematic one by comparing the different site setups in the applicationHost.config I tracked down the following setting under the applicationPools

<add name="WebsiteNameRemoved" autoStart="true" enableConfigurationOverride="false" managedPipelineMode="Integrated"> <processModel identityType="ApplicationPoolIdentity" /> </add>

the soulution is to set enableConfigurationOverride to true (it is by default true so removing it will also work)

so changing it to the following will resolve the issue

<add name="WebsiteNameRemoved" autoStart="true" enableConfigurationOverride="true" managedPipelineMode="Integrated"> <processModel identityType="ApplicationPoolIdentity" /> </add>
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.