How can I make www.mywebapp.com/bin return a 404 in ASP.NET MVC?

Question

I'm using ASP.NET MVC to develop a web application, deploying to IIS 7. I've hidden my Files and Views directories with web.config files in those directories (they just return a normal 404).

However, I haven't been able to get the web.config method to work in hiding my bin directory. When I access www.mywebapp.com/bin, I instead get a too-revealing page with this message:

HTTP Error 404.8 - Not Found

The request filtering module is configured to deny a path in the URL that contains a hiddenSegment section.

The page reveals part of my directory structure. I just want it to return my 404 page like the Files and Views directories do. How can I get this behavior?

Answer 1

A better bet would be to handle both 404 and 404.8 errors with the same, more user-friendly, error page that doesn't reveal the precise error code. You would also probably want to handle 403 errors (and probably some others that will be suggested by other SO users) in the same way.

For this, you need to use the <customErrors /> element in the web.config.

Answer 2

I have put in my error handling for pathing issues within my global.asax. I then check to see what the error was, in your case 404, and if it's a 404 I redirect them to /Home/Index.

If it's another error I direct to my error controller and handle the error there.

I hope this helps you. If you want code let me know.

Answer 3

I was able to solve this problem by adding a small web.config file in my ~/Files directory that rebuffs all attempts at exploration through the web. The web.config is very similar to what ASP.NET MVC puts in the Views directory by default:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <httpHandlers>
      <add path="*" verb="*" type="System.Web.HttpNotFoundHandler"/>
    </httpHandlers>
  </system.web>

  <system.webServer>
    <validation validateIntegratedModeConfiguration="false"/>
    <handlers>
      <remove name="BlockViewHandler"/>
      <add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler"/>
    </handlers>
  </system.webServer>
</configuration>