Restrict Downloadable Files

[Ideas Man]

Is it possible to be able to restrict files that a browser can access? For instance, any files in the bin directory are automatically classified as not existant, but how can you extend this to additional files such as databases etc that work the site, that the user shouldn't be allowed to download?

[mendhak]

Download this:
http://www.microsoft.com/technet/sec...s/urlscan.mspx

and add the extensions you want to the INI file.

[Ideas Man]

Is this how the ASP.NET files in the bin directory are protected, or can't you modify/add to that list?

[mendhak]

Sorry, this is the only way I know of. It's very likely that the list of extensions are stored in some IIS config file, but I do not know where they are. The link above is the only way I know of. You can add your extensions to the list associated with it.

[Ideas Man]

OK, thanks. Though I'll leave the topic open because it wasn't fully solved . Will try your solution and tell you how it goes.

[nemaroller]

The bin directory is most likely protected by the IIS server.

Any other protection that is afforded is made possible by setting authorization settings on a subfolder, and defining whom can access that folder.

[Ideas Man]

Do you mean like using Windows accounts to lock it down?