IIS 6 ignores Web.config authorization settings

Question

Context:

• IIS 6 on Windows 2003 Server
• ASP.NET 3.5 sp1
• C# Web Application running from a virtual directory

There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:

<location path="hibernate.cfg.xml">
    <system.web>
      <authorization>
        <deny users="?"/>
        <deny users="*"/>
      </authorization>
    </system.web>
</location>

OR

<httpHandlers>
...
    <add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>

The logs in a different directory can be protected through another Web.config file:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:

<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />

How do I make IIS 6 respect the authorization rules in Web.config.

Note: assume that I can't move these files outside of the deployment directory.

Answer 1

It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.

To work around this, I had to do the following (from this forum post):

1. From IIS Console, open properties of the virtual directory of my app.
2. Virtual Directory > Configuration
3. Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
4. All verbs. Uncheck both "Script engine" and "Verify that file exists".

Is there any way to do this from within Web.config?

Answer 2

Try this:

<location path="hibernate.cfg.xml">
    <system.web>
      <authorization>
        <deny users="?"/>
        <deny users="*"/>
      </authorization>
    </system.web>
</location>

Answer 3

Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.

Answer 4

To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:

1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)

2) in web.config add the location for the restricted directory or file

<location path="directory_or_file_name">
    <system.web>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
</location>

3) Add the following to the httpHandlers section:

<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />

This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.

Answer 5

URL Authorization: The URLAuthorizationModule class is responsible for URL authorization on Windows 2003. This mechanism uses the URL namespace to store user details and access roles. The URL authorization is available for use at any time. You store authorization information in a special XML file in a directory. The file contains tags to allow or deny access to the directory for specific users or groups. Unless specified, the tags also apply to subdirectories.

You need to do the following:

<deny users="?"/>
<deny users="*"/>

The wild card entry "?" means that no one else will be able to gain access to this directory.