views:

224

answers:

4

i have a couple of xml files in my asp.net web application that i don't want anyone to access other than my server side code. this is what i tried..

<add verb="*" path="*.xml" type="System.Web.HttpForbiddenHandler" />

i wrote this inside the <httpHandlers>

it works well on the localhost but not in the server... the server without any hesitation displays the xml file... i have no idea how to proceed...

thanks in advance..:)

Update: the server has IIS6, windows server 2003

+2  A: 

You could put them in the special App_Data directory. Files inside this folder are not served.

Darin Dimitrov
i don't think this is the perfect solution. It will work but is just a workaround.
ZX12R
+1 for this answer; it is not a workaround, it is perfect usage of App_Data
bgs264
+1  A: 

You should check what other handlers are active on the server and can affect the .xml files, including the generic ones like <add verb="*" path="*" ...

Also, check the server configuration as pointed here: httpHandlers Element (ASP.NET Settings Schema)

The Microsoft Internet Information Services (IIS) has its own model for mapping extensions to ISAPIs. For the mapping between a given application extension and its handler to take effect, the extension must be mapped in IIS to ASP.NET ISAPI. For nonstandard extension, such as custom extensions, you must configure IIS accordingly.

UPDATE: Protecting Files with ASP.NET

alexandrul
i checked very well and there is nothing colliding with my specific handler
ZX12R
@ZX12R: did you really check that xml files are mapped to ASP.NET ISAPI extension on the server?
alexandrul
can you please tell me how to do a thorough check of mappings.?
ZX12R
@ZX12R: updated the answer
alexandrul
whoa..I live in shared server spaces..! i have no access to IIS..:(
ZX12R
@ZX12R: then talk with the admins, they should help you
alexandrul
i think that is the last resort.. i tried my best to find a solution without touching the IIS..:(
ZX12R
@ZX12R since you are using an ASP.NET feature to restrict acces to the files, you MUST tell IIS to use ASP.NET for serving xml files. Or you could rename the xml files to an ASP.NET already handled extension (maybe something like abc.xml.aspx)
alexandrul
I'm in the same situation, except that I need to restrict the access to xml files based on some criteria. The xml files are needed for some flash app : http://stackoverflow.com/questions/2630049/httphandler-and-xml-files
Frank
A: 

What about using the <location> tag?

<configuration>
   <location path="something.xml">
      <system.web>
         <authorization>
            <deny users="*"/>
         </authorization>
      </system.web>
   </location>
</configuration>
Rahul Soni
I don't think i understand completely. should the <location> tag be placed in configuration root.? i thought only one <configSections> element is allowed per config file. kindly bear with me and explain..
ZX12R
Yes, in fact, I was suggesting to use location tag as mentioned in your web.config and point out the path of XML. Then in your auth tag, specify deny users = *. I haven't checked it, but I am hopeful that it should work
Rahul Soni
it works in localhost but fails in the server..!!
ZX12R
By any chance, can you send me your Application host config file?
Rahul Soni
am really sorry...i can't..
ZX12R
+1  A: 

IIS 6 & the Visual Studio built in Web Server register things a bit differently than IIS 7. If your host is running IIS 7, you may need to add your registration to the <system.WebServer> node in your Web.config file.

<system.webServer>
  <handlers>
    <add ... />
  </handlers>
</system.webServer>
Paul Alexander
have updated my question... the server uses IIS6..
ZX12R
If that's the case, @alexandrul's answer is probably correct. IIS handles all document requests directly unless mapped to another handler. Many hosting providers offer a control panel where you can map file extensions to specific handlers.
Paul Alexander