Block access to zip files using access rules

[Torben Laursen]

I have a website where the user can download zip files after logging in.
In the site I use access rules to control who can control what.

However to my big surprise the user cannot access aspx files in a folder
without logging in but he can access zip files without any problems!
The config file for the folder is this:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authorization>
<allow roles="members" />
<deny users="?" />
<deny users="*" />
</authorization>
</system.web>
</configuration>

Does anyone know how I block the access of zip files in a folder so only
people who are logged in can access them?

Thanks Torben

 

[bruce barker]

by default (for performance reasons) non asp.net file are not mapped to
asp.net for processing. thus asp.net security has no effect. in iis you need
to map the zip files to be processed by asp.net

-- bruce (sqlwork.com)