Deny access to html page

Question

I have ASP.NET Web Forms project. I created a folder Demo in this project and put in this folder HelloWorld.html. I need deny access to this

Answer 1

Your web.config is correct. The problem is this secures files that are going through the ASP.NET pipeline. Certain static files, like html files, are served up directly by IIS and so it is bypassing your security.

You can force static files to go through the ASP.NET pipeline by adding a handler for them under the <system.webServer> section of your web.config:

<handlers>
    <add name="HTMLHandler" type="System.Web.StaticFileHandler" path="*.html" verb="GET"  />
</handlers>