How To Deny Access To File But Allow Server

Question

I have a web application that has a configuration folder that houses multiple XML files that are configuration settings for multiple "portals" as you will. I need IIS to have access to them so the "portal" loads (sql connection strings, master page paths) but I want to deny any outside access (url browsing). Here's an example below:

http://www.mywebsite/virtualdirectory/configurationdirectory/configfile.xml

I need to restrict access to this file if you're browsing to it but still allow the system access to it so it can parse the "portal" that it's loading.

Any ideas?

Answer 1

You could do this with a rewrite rule

You can also do this with a Request Filtering rule

Answer 2

If the website doesn't need to serve XML files to the end user then remove it as a MIME type.