views:

37

answers:

4

Hi..

Just wondering is there any drawbacks to publishing a ASP .NET web application by copying all the files in it? (That means all the .cs, .csproj files will be included in the published folder)

So far I can think that the published folder's total size may become a little bigger (but that a negligible issue for me).

+1  A: 

I would also have some security concerns here as you are posting files to a (production?) server that have no business being there. If one was to compromise your server or find a way to get those files from IIS, they could in theory gain access to all of the .cs files used to create your dll's for your web app. Space is another concern as well.

Tommy
IIS by default blocks downloads of code files (.cs, .vb). Can't find a reference for it at the moment...
Will
Yes, I know this, but if his server was compromised in some way or if the IT guys get some idea that IIS should serve up .cs files, that wouldn't really matter. I guess, for me, it is the pricipal of least amount of stuff needed to make something work. Sort of like, well our firewall blocks service A, so it doesn't matter if it is running or not. If your not using it, close the hole.
Tommy
A: 

What, apart from making the publishing process more complex than need be?

Will
+1  A: 

When publishing the codebehind-files malicious users could access your code, and find an opening for attacks.

rdkleine
+1  A: 

I do only the files needed to run the site, but more from an intellectual property standpoint. The business logic and data access stuff is mine. My client gets what they need to run their site and go about their business. They didn't pay me to know how I accomplish those things. I want them to have to come back to me and need me to make a change, not pass it off to someone else who might benefit from my design (although, that's doubtful, I've seen my code).

Anthony Potts