如何编辑的web.config停止服务的.NET Web应用程序特定的文件类型 [英] How to edit web.config to stop serving a specific file type of a .NET web app

问题描述

我想prevent用户通过浏览器访问一个特定类型的文件。例如，IIS服务器阻止访问的.config，默认情况下.VB文件，从而错误消息您所请求不提供早餐，因为它已经被明确禁止的页面类型，我想添加其他文件类型此行为。

I'd like to prevent users from accessing files of a certain type through their browser. For example, the IIS server blocks access to .config and .vb files by default, giving the error message "The type of page you have requested is not served because it has been explicitly forbidden", and I'd like to add other file types to this behavior.

有什么我可以添加到应用程序的web.config文件？我宁可不使用阻止目录访问处理它＆LT;授权＆GT; 元素

Is there something I can add to the application's web.config file? I'd rather not handle it by blocking directory access using the <authorization> element.

推荐答案

在IIS 7+，请求过滤可以在应用程序层面进行。添加下面的code在web.config中：

In IIS 7+, request filtering can be done at the app level. Add the below code in web.config:

<system.webServer>
    <security>
        <requestFiltering>
            <fileExtensions>
                <add fileExtension=".vbs" allowed="false" />
            </fileExtensions>
        </requestFiltering>
    </security>
</system.webServer>

有关IIS 6，以上将无法正常工作，但你可以模仿存在类似的.cs文件页面的默认阻止行为，虽然你可能不得不作出在服务器端的变化。首先，添加以下到您的应用程序的web.config：

For IIS 6, the above won't work but you can mimic the default blocking behavior that exists for pages like .cs files, although you may have to make changes on the server side. First, add the below into your app's web.config:

<system.web>
    <httpHandlers>
        <add path="*.vbs" verb="*" type="System.Web.HttpForbiddenHandler" validate="True"/>
    </httpHandlers>
</system.web>

如果asp.net设置为处理该文件类型，像的.cs，然后就大功告成了。但是，如果你的意思是要阻止的文件类型由IIS处理，而不是asp.net（如名为.vbs），这是不够的。你必须做出改变在IIS管理器映射文件扩展名如图所示的这里。

If asp.net is set up to handle that file type, like .cs, then you're done. However, if the file type you mean to block is handled by IIS, not asp.net (like .vbs), this won't be enough. You'll have to make changes in IIS Manager to map the file extension as shown here.

这篇关于如何编辑的web.config停止服务的.NET Web应用程序特定的文件类型的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！