ASP.NET Serving Word Documents

Question

I have an application that has a subfolder called "Docs" (actually a virtual directory) where I keep all of my word documents. I don't want these documents to be accessed by any unauthenticated users but for some reason regardless of what I put in my root web.config or my "Docs" web.config IIS still serves the word up to any user.

Answer 1

I assume the files in that folder are .doc

Unless you have modified your IIS configuration, .doc files are not handled by ASP.NET (they should by default be handled by the straight IIS file handler). That means the asp.net dll never sees the request, and so any settings in ASP.NET's web.config file are meaningless.

You would need to configure IIS to identify .doc files as being handled by the ASP.NET dll, or use a wildcard mapping so that all files on your server go through ASP.NET (keep in mind that this adds overhead to have every single static file request go through a full server side programming framework)

Answer 2

Your virtual directory is a separate app that might not be governed by the root. Add the web.config and mappings to the virtual directory.

If this is just a personal thing (your question reads two ways), I would just use an IIS-level password on the folder by removing anonomous access.