How do I restrict access to files with specific extensions in ASP.NET?

I have in my web application an ADO.NET Entity-Framework *.edmx file.

When I browse in the browser (when the application is running) to an edmx file, it doesn’t show the error page like when browsing to a *.cs or vb file, it opens the edmx and shows my model scheme to all the users!!!

How can I avoid that.

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

You should map the extension to the ASP.NET’s System.Web.HttpForbiddenHandler class in web.config. If you are using IIS6, before you could do that, you should have mapped the extension to ASP.NET ISAPI handler.

IIS7 Integrated Mode:

<system.webServer>
    <handlers>
        <add name="MyForbiddenExtensionHandler" 
             path="*.edmx" 
             verb="*" 
             type="System.Web.HttpForbiddenHandler" 
             preCondition="integratedMode" />
    </handlers>
</system.webServer>

IIS7 Classic Mode. Something like:
<system.web>
  <httpHandlers>
     <add path="*.edmx" 
         verb="*" 
         type="System.Web.HttpForbiddenHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
  </httpHandlers>
</system.web>
<system.webServer>
  <handlers>
     <add name="MyExtensionISAPI" 
         path="*.edmx" 
         verb="*" 
         modules="IsapiModule" 
         scriptProcessor="C:WindowsMicrosoft.NETFramework64v2.0.50727aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv2.0,bitness64" />
  </handlers>
</system.webServer>

IIS6 (after mapping the handler to aspnet_isapi.dll in IIS6 configuration):
<system.web>
  <httpHandlers>
     <add path="*.edmx" 
         verb="*" 
         type="System.Web.HttpForbiddenHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
  </httpHandlers>
</system.web>

Method 2

You can do this two ways; firstly in the web.config or secondly in IIS

<system.web>
    <httpHandlers>
        <add verb="*" path="*.edmx" type="System.Web.HttpForbiddenHandler" />
    </httpHandlers>
</system.web>

Here’s a link to a microsoft support page that details how to do it in the web config and IIS.

http://support.microsoft.com/kb/815152


All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes
Article Rating
Subscribe
Notify of
guest

0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x