Dear Dudes, How can I prevent HTTP access to my .MDB files?

[Babbling Brooke]

Dear Dudes,

I have a hosted ASP.NET website, and I want to prevent HTTP access to my
..MDB database file. The following is in my web.config at root of website:
.. . .
<httpHandlers>
<add verb="*" path="*.mdb" type="System.Web.HttpForbidden­Handler"/>
</httpHandlers>
.. . .
However, this had no effect. If I type http://www.mywebsite.com/db/mydb.mdb
in Internet Explorer, I get the dialog allowing me to open or save the file.

Any futher suggestions?

 

[Peter Rilling]

It has no effect because database files are not processed by the
aspnet_isapi filter. Two ways you can do this, configure the virtual root
to send the MDB files through the aspnet_isapi.dll filter, or move the file
out of the virtual root. The later is preferable.