IIS7, web.config to allow only static file handler in directory /uploads of website

by

Add the following to a web.config file in the folder containing the files you wish to be served only as static content:

<configuration>
    <system.webServer>
        <handlers>
           <clear />
            <add 
                name="StaticFile" 
                path="*" verb="*" 
                modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" 
                resourceType="Either" 
                requireAccess="Read" />
        </handlers>
        <staticContent>
            <mimeMap fileExtension=".*" mimeType="application/octet-stream" />
        </staticContent>
    </system.webServer>
</configuration>

More Related Contents:

  1. Remove Server Response Header IIS7
  2. How does the SQL injection from the “Bobby Tables” XKCD comic work?
  3. Are HTTP cookies port specific?
  4. Salt Generation and open source software
  5. Is “double hashing” a password less secure than just hashing it once?
  6. Authentication versus Authorization
  7. Where to store JWT in browser? How to protect against CSRF?
  8. Is it safe to enable CORS to * for a public and readonly webservice?
  9. Convert .pfx to .cer
  10. Preventing Brute Force Logins on Websites
  11. Does HTML5 allow you to interact with local client files from within a browser
  12. HTTP Error 500.19 – Internal Server Error
  13. Docker and securing passwords
  14. Is there any possible ways to bypass cloudflare security checks?
  15. Send mail via Gmail with PowerShell V2’s Send-MailMessage
  16. Is it secure to submit from a HTTP form to HTTPS?
  17. Is JSONP safe to use?
  18. How to prevent arbitrary client apps from using anonymous web API?
  19. Is HTTP header Referer sent when going to a http page from a https page?
  20. Using Symfony2’s AccessDeniedHandlerInterface
  21. Is it safe to enable ”Access-Control-Allow-Origin: *“ (wildcard) for a public and readonly webservice?
  22. Why not use HTTPS for everything?
  23. Where is the PEM file format specified?
  24. Difference between CSRF and X-CSRF-Token
  25. MD5 security is fine? [closed]
  26. Google Authenticator available as a public service?
  27. Unrecognized attribute ‘targetFramework’. Note that attribute names are case-sensitive
  28. Securing an API: SSL & HTTP Basic Authentication vs Signature
  29. Should be used for JSF 2.2 CSRF protection?
  30. Setting cookie in iframe – different Domain

Leave a Comment