I am contributing to a fairly large ASP.NET MVC web app that uses C#, JS, IIS 10, and .NET 4.6.1.
When a user is using the app, the homepage URL they see is [domain]/[appName]/[tenantName], and any other page they visit will be added on to that – e.g., domain/appName/tenantName/pageName.
However, these 3 directories exist:
- domain/appName/images
- domain/appName/scripts
- domain/appName/content
Currently, if a (logged in) user types any of those URLs into a browser, they will see a 403 Forbidden error because directory browsing is disabled and there is no default document for those 3 directories.
However, it is a security issue to even admit those directories exist. I would prefer to hide them completely – that is, to give a 404 error.
Unfortunately, nothing I have tried so far is having the desired effect.
I tried adding these directories to the ‘hidden segments’ list in IIS, but this broke my app because my code itself was no longer able to access the directories.
I tried creating URL rewrite rules through IIS. For example, I tried a rule that rewrites ‘images’ to the default tenant name, just to see if it worked. Since I always debug as the default tenant, this should have shown me the homepage. However, this seemed to have no effect whatsoever: I was still shown the 403.14 page that explains the directory browsing is disabled and there is no default document. (I also tried URL rewrites with/without forward slashes before and/or after the directory name, and the result was the same: no change whatsoever.)
[note: I didn’t even try doing a rewrite to a URL that would actually yield a 404 because like I say, the rewrite didn’t seem to be working at all anyway.]
[also note: I have already tried the two answers here. Adding the rewrite rule seemed to have no effect, and using ‘deny URL sequences’ broke my app by denying access to my own code.]
Is it possible that the no-directory-browsing rule is just being applied before the rewrite rule? Searching web.config for ‘directory’ or ‘brows’ yields no results, so if this is the issue, I don’t know how to get around it.
Or am I barking up the wrong tree here? As I say, I just want a 404 when a user tries to navigate to those 3 specific URLs.
And yes, I know those directories can be discovered by other means – for example, right-clicking an image and selecting ‘Open in new tab’ will reveal that it is stored in the ‘images’ directory. For now, that’s not a concern.