2

i have a couple of xml files in my asp.net web application that i don't want anyone to access other than my server side code. this is what i tried..

<add verb="*" path="*.xml" type="System.Web.HttpForbiddenHandler" />

i wrote this inside the <httpHandlers>

it works well on the localhost but not in the server... the server without any hesitation displays the xml file... i have no idea how to proceed...

thanks in advance..:)

Update: the server has IIS6, windows server 2003

5 Answers 5

2

You should check what other handlers are active on the server and can affect the .xml files, including the generic ones like <add verb="*" path="*" ...

Also, check the server configuration as pointed here: httpHandlers Element (ASP.NET Settings Schema)

The Microsoft Internet Information Services (IIS) has its own model for mapping extensions to ISAPIs. For the mapping between a given application extension and its handler to take effect, the extension must be mapped in IIS to ASP.NET ISAPI. For nonstandard extension, such as custom extensions, you must configure IIS accordingly.

UPDATE: Protecting Files with ASP.NET

8
  • i checked very well and there is nothing colliding with my specific handler
    – ZX12R
    Mar 16, 2010 at 6:47
  • 1
    @ZX12R: did you really check that xml files are mapped to ASP.NET ISAPI extension on the server?
    – alexandrul
    Mar 16, 2010 at 7:48
  • can you please tell me how to do a thorough check of mappings.?
    – ZX12R
    Mar 16, 2010 at 8:30
  • whoa..I live in shared server spaces..! i have no access to IIS..:(
    – ZX12R
    Mar 16, 2010 at 9:14
  • @ZX12R: then talk with the admins, they should help you
    – alexandrul
    Mar 16, 2010 at 9:32
2

You could put them in the special App_Data directory. Files inside this folder are not served.

2
  • i don't think this is the perfect solution. It will work but is just a workaround.
    – ZX12R
    Mar 16, 2010 at 6:53
  • +1 for this answer; it is not a workaround, it is perfect usage of App_Data
    – bgs264
    Mar 16, 2010 at 12:06
1

IIS 6 & the Visual Studio built in Web Server register things a bit differently than IIS 7. If your host is running IIS 7, you may need to add your registration to the <system.WebServer> node in your Web.config file.

<system.webServer>
  <handlers>
    <add ... />
  </handlers>
</system.webServer>
1
  • If that's the case, @alexandrul's answer is probably correct. IIS handles all document requests directly unless mapped to another handler. Many hosting providers offer a control panel where you can map file extensions to specific handlers. Mar 16, 2010 at 7:58
0

What about using the <location> tag?

<configuration>
   <location path="something.xml">
      <system.web>
         <authorization>
            <deny users="*"/>
         </authorization>
      </system.web>
   </location>
</configuration>
3
  • I don't think i understand completely. should the <location> tag be placed in configuration root.? i thought only one <configSections> element is allowed per config file. kindly bear with me and explain..
    – ZX12R
    Mar 16, 2010 at 6:45
  • Yes, in fact, I was suggesting to use location tag as mentioned in your web.config and point out the path of XML. Then in your auth tag, specify deny users = *. I haven't checked it, but I am hopeful that it should work
    – Rahul Soni
    Mar 16, 2010 at 6:53
  • By any chance, can you send me your Application host config file?
    – Rahul Soni
    Mar 16, 2010 at 10:49
0

i also faced the similar issue. In my localhost, crud operations are working fine and displaying the data on the grid but same not working on hosted url in virtual machine behaving freaky, cause: I was calling handlers one after the other like, after saving in the call back i was calling again one more handler to display the data in the grid in these two calls save is happening properly but display handler was not hitting only in fiddler. Sol: So i tried to sending data in the serialize format in the callback of save to display, this solved my problem its just a fast fix don't know why exactly its not working.

ideally multiple calls to handler should work i feel, but if you call multiple handlers one after the other problem may occur like this, instead of that try to get in data in one call only, it may help you to resolve the issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.