I use IIS with a Web API to access information about various resources. One of the names of one of the resources is “BIN”. I understand and am glad of how IIS protects me from evil-doers that might search for way to invade the “bin” folder in the app. But. I have a resource with the name of BIN and I don’t have a choice about its name.

There are many paths to the many versions of the BIN resource. I can allow a URL with the configuration/security/requestFiltering/alwayAllowedUrls element in the web.config, adding an entry for each of the paths to the BIN resource. These paths are versioned, so each new version (once a quarter) the set of paths in the web.config need to be duplicated with new versions. This approach isn’t exactly scalable. Is there a better way to expose the specific BIN resources while maintaining the basic protection against people finding my bin folder?