Authorization settings for a folder in ASP.NET

Question

I have an asp.net web site, I want restrict all users to access a folder named "log" and I have this element in web.config:

<location path="log">
    <system.web>
     <authorization>
      <deny users="*"/>
     </authorization>
    </system.web>
</location>

and this element before it in system.web:

<authorization>
 <allow users="*"/>
</authorization>

but still I have access to this url: http://www.mydomain.com/log/log.txt

Any ideas?

Thanks.

Answer 1

.txt files are not handled by ASP.NET by default. You'll have to block access to the folder from within IIS.

If you're using IIS 7 you can use Request Filtering to achieve this.

Answer 2

to avoid this confusions I usually create one web.config file at the directories i need to set different permissions.

If you place a web.config file inside your log folder it will work ok (and it will become easier to check the applied permissions at the folder)

Example:

<?xml version="1.0"?>
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"&gt;
    <system.web>
    <authorization>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>