tags:

views:

36

answers:

1
+1  Q: 

Website is ignoring System.Web.HttpForbiddenHandler and allowing download of web.config

My website is allowing the web.config file to be downloaded. However in my C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config file I have this line

<add path="*.config" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>

Which should mean any config file can't be downloaded.

What am I missing?

A: 

It's not really a solution but more of a work around: I ended up setting the file to "hidden" in windows and encrypting the web.config...just in case.

By setting it to hidden the webserver does not serve it up but it can still be used by the asp.net application to run.

Benny  2010-09-11 22:05:45

related questions

How to compile a C# file outside of App_Code?
Web.Config Falling back to Global Config in Web Farm
Setting up a backup DB server in ASP.NET web.config file
Programmatically register HttpModules at runtime
log4net with ASP.NET 3.5 problems
Do these values belong in a config file or database?
In my codebehind class, how do I retrieve the authorized roles?
Is it possible to pass a App setting in the web.config to a Common C# class
Where is the official, extensive, complete documentation on web.config?
Storing values in the web.config - appSettings or configSection - which is more efficient?
MVC with SharePoint
How to change SharePoint extended web application's web.config file
Log4Net "Could not find schema information" messages
How can I set up a configuation file for .NET console applications?
How to initialize ConnectionStrings collection in NUnit
Bare Minimum Configration for RESTful WCF
What's the difference between a worker thread and an I/O thread?
Problem encrypting membership element in web.config
ASP.NET/IIS: 404 for all file types
HTTPHandler tag in Web.Config breaks asmx Files...
ASP.NET MVC Preview 5 - Html.Image helper has moved namespace
Relative path in web config
Detecting Web.Config Authentication Mode
Removing web.config from subversion (ASP.NET Project)
live asp.net web.config settings