I have some sensitive files that I want the web server to be able to use, but I do not want them to be accessible from a web browser.
I am having a really hard time finding any documentation that describes which folders in ASP.Net are hosted publicity and which are private. For instance I know the Content and Scripts directory are public, but I see no configuration or options that show granting access to those paths.
What folders are web accessible? And where would it be safe to put these sensitive files?
Thanks for the help!
have some sensitive files that I want the web server to be able to
use, but I do not want them to be accessible from a web browser.
~/App_Data is for you. Here's a list of the different ASP.NET special folders.
I'm not sure about which special folders are locked down (other than App_Data & bin), but you can block any folder from being web accessible by adding an <authorization/> section to a <location/> section to your web.config:
<!-- Block access to Admin directory -->
<location path="Admin">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>
Alternatively, you can add a web.config directly to the directory you want to block, containing the following:
<?xml version="1.0"?>
<!-- This web.config blocks access to any directory it is put in,
and its subdirectories -->
<configuration>
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</configuration>
These approaches are functionally identical, it just depends on your preference. Personally, I think having the web.config file in the directory you're blocking access to is a little less confusing.
Related
Like the title says, I want to protect a directory from anonymous access and that directory is ignored for routing because it contains static content.
I should also mention I'm just using the out of box individual accounts identity stuff in my MVC app.
The other catch I have is that I will be hosting as an Azure web app.
Ignore route looks like:
routes.IgnoreRoute("Cordova/{*pathInfo}");
That works just fine.
I thought I could just add a location exclusion in my web.config:
<location path="Cordova" >
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
With just that, I can still access the content as an unauthenticated user, so that isn't it alone.
Then in the Web.config, system.webServer->modules section I added:
<remove name="UrlAuthorization" />
<add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
Now it will deny access to the directory (when using the location element above), BUT it will not allow access to any authenticated user.
I saw a few other suggestions that involved tweaking IIS settings or local directory permissions, but since I'm hosting in Azure, that is not an option for me.
UPDATE
I implemented forms authentication in the web config, and manually added the FormsAuthentication calls in my Account controller. AND it works!
So I'm guessing the web.config deny="?" in the location element is only enforceable with forms auth??
Now I have the forms auth mixed in with the OWIN cookie auth stuff. I thought one used the other (what happened to app.UseFormsAuthentication?) but its not looking that way. I'm making a mess.
How should I be doing this?
UPDATE2
And in doing so now my WebAPI security is broken.
I have an Asp.Net MVC site that uses forms authentication and has no 'public' access. Unauthenticated requests redirect to my Login controller. In the View I am referencing css and js files via Bundles. However, when deployed, the requests to these bundles all redirect to the login page with a RedirectUrl parameter. Make sense?
So, how can I get specific bundles to be accessible without authentication being required?
As a poor workaround I know that I can just reference the individual files placed in a public folder - but this circumvents all the minimising benefits.
Thanks.
There are a couple of things you need to do.
First, change the name of the scripts and styles you want to render to be something that doesn't conflict with a folder in your application. So if you have ~/Content/styles folder, name your style bundle something like ~/Content/styles/css.
The /css at the end of the bundle name is to prevent the request from being treated like a script.
Second, you need to add authorization for the Content or whatever you call your bundle path as referenced in your web.config
<location path="Content"> <!--or whatever you call your bundle path instead of Content-->
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
This will prevent the forms authentication redirect and serve up your content.
you should be putting these bundles on the Master view page
on the master page you should have something like this:
#RenderSection("scripts", required: false)
in your view just add your scripts like this:
#section Scripts{
//put all your scripts here
}
you can define a section for stuff you need in the header and do the same for the css.
If this doesn't work you may need to make sure that your bundle names don't conflict with the names of actual paths in your sites, or else the mvc engine will handle the requests rather than serving up your files.
worst case you have to enable anonymous access to your directories in web.config
<configuration>
<location path="content">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
<location path="scripts">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>
</configuration>
I have a file on disk in the path /Files/filename.txt and the MVC routing system checks if the file exists before using its routing logic (with controller, action...).
I want to use routing logic before matching files on disk.
If I set "RouteExistingFiles=true" it will ALWAYS use routing over matching files. I want this behaviour only for a particular folder.
The "FilesController" must be called even if the file in Files folder exists. Basically I want the opposite behaviour of "IgnoreRoute()".
How can I achieve that?
Your going to have to take a two part approach to this.
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
<location path="files">
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>
Make sure that your runAllManagedModulesForAllRequests in your web.config is true in order for the UrlAuthorizationModule to run for static files.
Your going to need to specifically stop asp.net from serving up the files in the folder named files. You can do this by adding a location entry in to your web.config inside of the configuration node. This is specifically telling the Authorization Module that no matter who the user is they do not have access to this folder.
After this has been done then your FilesController will now be in charge of serving the files up for the files folder.
I am sure this has something to do with IIS but I can't figure it out.
I have a website using forms authentication. When my website tries to access any file resources (javascript files, css, etc), I am redirected to the forms login page set in my web.config. I also get redirected if I just type the address into the address bar.
The web.config entry for forms auth is pretty basic:
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
There are also two location nodes to deny users from other parts of the site:
<location path="n2">
<system.web>
<authorization>
<allow roles="Editors" />
</authorization>
</system.web>
</location>
<location path="web.config">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>
I am using the standard IIS7 install on Windows Server 2008 R2.
Edit
So, if I add a random auth cookie (FormsAuthentication.SetAuthCookie()), the resources become available, I know it has to be my authentication model that's messed up somehow. It works on another server (I just copied it over). Any ideas how I can track the problem down?
I had the same error, in my case the trick was setting Anonymous Authentication to use the App Pool identity instead of IUSR in IIS
Open IIS
Expand Sites
Select [YourWebSite]
Double click Authentication (will be under the IIS "Area" or the Security "Category")
Select Anonymous Authentication
Click Edit in the Actions pane
Click the 'Application pool identity' radio button
Don't use <location> tags in web.config to handle authorization in an ASP.NET MVC application as locations have no longer any sense. All you need in web.config is the authentication tag. In MVC authorization could be achieved by decorating proper controllers and/or actions with the [Authorize] attribute.
I use allow * for my Content folder. That will prevent any authorization from happening for static content.
<location path="Content">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
Rick
In IIS, my Anonymous Authentication was on correctly and the user was set to IUSR. Therefore, I needed to go into Windows Explorer, navigate to my web app directory, right-click for Properties, Security tab, Edit button, and give IUSR Read, List, and Read & Execute permissions (the default set). Ensure the changes will be inherited by all children, apply, possibly wait, and you're good to go.
It's been along time since I did any asp.net forms work but the first questions would be - are you sure your user is a member of the "Editors" role. You can use the Web Site Administration tool to set this up I think?
http://msdn.microsoft.com/en-us/library/ssa0wsyf.aspx
That is because you have set deny to everyone. In IIS 7, because of the integrated pipeline you will get redirected even when you try to browse CSS or any static page.
Put the static content inside a folder if you like and allow access to it.
I had exactly the same and found it was because I had forgotten to allow anonymous access to the website from inside IIS! This meant that the FormsAuthentication was always kicking in, even for the static resources that were not protected.
We're using Elmah as our error logging system for an app that will be going into production soon. It's extremely useful, but if it goes into production like this anyone in the world access the error log because all they have to do is visit ourdomain.com/elmah.axd.
This is obviously not ideal. I originally intended to restrict access to that page only to IP addresses within our company, but now our SysAdmins are saying that's not possible. So I'm asking here how can I prevent access to this resource?
We running an ASP.NET MVC app on IIS 6.
The typical scenario for securing elmah.axd is allowing only some authenticated user to be able to access it. But if your site doesn't use any authentication at all this might not be applicable.
Here's what I would recommend you:
Disable completely the elmah.axd handler on your main site
Configure elmah to write the logs to some shared data source (like a shared file, SQLite database or even SQL Server)
Configure a second site in IIS, probably on another network or server, which has only elmah installed and which points to this same shared data source. Now you would always use the second site to read the logs. Obviously the second site would only be accessible to you.
If you decide to use SQL Server you could even read the logs of multiple applications running on multiple web servers in a farm from within a single internal application accessible only to you.
I found this is most acceptable for MVC applications:
http://www.beletsky.net/2011/03/integrating-elmah-to-aspnet-mvc-in.html
You can point the elmah http handler to another url (for example "Secure/elmah.axd") in web.config. You can secure the url as any other asp.net page in the web config.
<httpHandlers>
...
<add verb="POST,GET,HEAD" path="/Secure/elmah.axd" type="Elmah.ErrorLogPageFactory, Elmah" />
</httpHandlers>
<location path="Secure" > <!-- secure the host.com/Secure path -->
<system.web>
<authorization>
<deny users="?" />
<!-- Or anything else... -->
</authorization>
</system.web>
</location>
We are successfully using this approach on IIS7 using active directory membership providers, and it works great. I am not sure if it works on IIS6 though.
If you're using ASP.NET Membership, it's pretty easy to restrict access to the elmah.axd HttpHandler for anonymous users and only allow logged in users in an "Administrators" group. I've done it like this:
<configuration>
...
<location path="elmah.axd">
<system.web>
<authorization>
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
</configuration>
Anybody who's logged in AND member of the "Administrators" role can access the page now.
Here are some useful links:
Securely Implement ELMAH For Plug And Play Error Logging
Securing Error Log Pages
If your intention is to disable remote users from accessing it, simply change the value of <security allowRemoteAccess="yes" /> to <security allowRemoteAccess="no" />
I used IP Restrictions from the IIS 7 configuration. By default, you can't simply apply it in <location path="elmah.axd"> because it's locked on the parent configuration level. As such, I created an empty folder "logs" and applied restrictions in IIS to this folder, then modified the location path for the elmah.axd file. That's it! You have remote access to yourdomain.com/logs/elmah.axd, but only from specific IPs.