asp.net forms authentication for all content

[Paul Cowan]

Hi,

I am running framework 1.1 on iis 6.0, I have forms authentication
setup and everything is running really smoothly, but I do have a small
question that would make my life a bit easier, and give my client
great piece of mind.

When configuring mappings for which executable to use when particular
extensions are requested in a web, is there any way to specify that
all extensions must be mapped to asp.net? In my optimism I tried .*
but iis complained saying it had the wrong extension format,
understandably.

I have mapped a few common ones (.doc, .pdf etc...) and they are
working fine, but my fear, and my clients fear, is that one of their
users is going to publish something sensitive in a format or with an
extension that we haven't thought of.

Thanks for any help in advance.
Paul.

[Philip Q [MVP]]

Paul Cowan wrote:

Hi,

I am running framework 1.1 on iis 6.0, I have forms authentication
setup and everything is running really smoothly, but I do have a small
question that would make my life a bit easier, and give my client
great piece of mind.

When configuring mappings for which executable to use when particular
extensions are requested in a web, is there any way to specify that
all extensions must be mapped to asp.net? In my optimism I tried .*
but iis complained saying it had the wrong extension format,
understandably.

I have mapped a few common ones (.doc, .pdf etc...) and they are
working fine, but my fear, and my clients fear, is that one of their
users is going to publish something sensitive in a format or with an
extension that we haven't thought of.

Thanks for any help in advance.
Paul.

Strange, I tried this in IIS 5.1 and it seems to accept it (don't know
if it works or not).

I can't think of a way to do a catch-all like this. A dirty solution
would be to restrict the uploading of users to the document types that
you have secured.

--
Philip Q
Microsoft MVP [ASP.NET]