IIS 6 ignores Web.config authorization settings

Question

Context:

• IIS 6 on Windows 2003 Server
• ASP.NET 3.5 sp1
• C# Web Application running from a virtual directory

There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:

<location path="hibernate.cfg.xml">
    <system.web>
      <authorization>
        <deny users="?"/>
        <deny users="*"/>
      </authorization>
    </system.web>
</location>

OR

<httpHandlers>
...
    <add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>

The logs in a different directory can be protected through another Web.config file:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:

<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />

How do I make IIS 6 respect the authorization rules in Web.config.

Note: assume that I can't move these files outside of the deployment directory.

Answer 1

Try this:

<location path="hibernate.cfg.xml">
    <system.web>
      <authorization>
        <deny users="?"/>
        <deny users="*"/>
      </authorization>
    </system.web>
</location>

Answer 2

URL Authorization: The URLAuthorizationModule class is responsible for URL authorization on Windows 2003. This mechanism uses the URL namespace to store user details and access roles. The URL authorization is available for use at any time. You store authorization information in a special XML file in a directory. The file contains tags to allow or deny access to the directory for specific users or groups. Unless specified, the tags also apply to subdirectories.

You need to do the following:

<deny users="?"/>
<deny users="*"/>

The wild card entry "?" means that no one else will be able to gain access to this directory.

Answer 3

It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.

To work around this, I had to do the following (from this forum post):

1. From IIS Console, open properties of the virtual directory of my app.
2. Virtual Directory > Configuration
3. Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
4. All verbs. Uncheck both "Script engine" and "Verify that file exists".

Is there any way to do this from within Web.config?

Answer 4

Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.