F
Frank
I have a simple asp.net 2.0 application that includes two components:
- a file uploader
- a lister of files that have been uploaded
Files are word processing documents; they get stored to a "papers"
subdirectory of the application.
It would be good if both the file lister *and* the files in "papers"
were secured. But I sense that IIS and asp.net do not work together
to protect documents that aren't aspx files.. For example, I put an
index.html file into the papers directory, and asked IIS for that
document, and was happily sent the document. This, despite a
<location path="papers"> section in my web.config that includes <deny
users="?" />.
I know how to secure a directory with IIS. What I didn't want to do
was secure both the listing.aspx component *and* the papers
directory. I suppose another approach would be to put the lister.aspx
file into the papers directory and secure the directory with IIS and
forget the authentication in asp.net. But that seems wrong.
So, maybe someone could tell me where my thinking's gone wrong.
Thank you very much.
- a file uploader
- a lister of files that have been uploaded
Files are word processing documents; they get stored to a "papers"
subdirectory of the application.
It would be good if both the file lister *and* the files in "papers"
were secured. But I sense that IIS and asp.net do not work together
to protect documents that aren't aspx files.. For example, I put an
index.html file into the papers directory, and asked IIS for that
document, and was happily sent the document. This, despite a
<location path="papers"> section in my web.config that includes <deny
users="?" />.
I know how to secure a directory with IIS. What I didn't want to do
was secure both the listing.aspx component *and* the papers
directory. I suppose another approach would be to put the lister.aspx
file into the papers directory and secure the directory with IIS and
forget the authentication in asp.net. But that seems wrong.
So, maybe someone could tell me where my thinking's gone wrong.
Thank you very much.