Security issue with .htm pages in folders

[Magnus Blomberg]

Hi there!

I am using VS 2005 beta for developing my new web application.
I have a security issue, that I don't know if it is wrong by me, an IIS6 problem or an VS beta problem.

I have a web application where the first page is public and IIS is set up with Anonymous login enabled and Integrated Windows authentication.
All other pages is placed under a folder called Protected created from VS.
My web.config looks like this (shrinked):

<system.web>
<authentication mode="Windows"/>
</system.web>
<location path="Protected">
<system.web>
<authorization>
<allow users="projdev\prospects"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

The problem is that I CAN browse all .htm pages under the folder Protected. The pages named .aspx is protected as they should.

Is it not "allowed" to use .htm pages in my app, or am I doing something wrong?

Regards Magnus

[Rutger Smit]

Magnus Blomberg wrote:

Hi there!

I am using VS 2005 beta for developing my new web application.
I have a security issue, that I don't know if it is wrong by me, an IIS6
problem or an VS beta problem.

I have a web application where the first page is public and IIS is set
up with Anonymous login enabled and Integrated Windows authentication.
All other pages is placed under a folder called Protected created from VS.
My web.config looks like this (shrinked):

<system.web>
<authentication mode="Windows"/>
</system.web>
<location path="Protected">
<system.web>
<authorization>
<allow users="projdev\prospects"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

The problem is that I CAN browse all .htm pages under the folder
Protected. The pages named .aspx is protected as they should.

Is it not "allowed" to use .htm pages in my app, or am I doing something
wrong?

Regards Magnus

..htm and .html files are not handles by the asp(.net) parser so you can
request them without a problem.

To change this: rename the files to .aspx or let the htm(l) files being
parsed.

--

//Rutger

DoDotNet@KICKTHIS_Gmail.com
www.RutgerSmit.com

[Magnus Blomberg]

Ok, then I know. I will rename them.
Thanks

Regards Magnus
"Rutger Smit" <DoDotNet@KICKTHIS_Gmail.com> wrote in message
news:#S**************@TK2MSFTNGP15.phx.gbl...

Magnus Blomberg wrote:

Hi there!

I am using VS 2005 beta for developing my new web application.
I have a security issue, that I don't know if it is wrong by me, an IIS6
problem or an VS beta problem.

I have a web application where the first page is public and IIS is set
up with Anonymous login enabled and Integrated Windows authentication.
All other pages is placed under a folder called Protected created from VS. My web.config looks like this (shrinked):

<system.web>
<authentication mode="Windows"/>
</system.web>
<location path="Protected">
<system.web>
<authorization>
<allow users="projdev\prospects"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

The problem is that I CAN browse all .htm pages under the folder
Protected. The pages named .aspx is protected as they should.

Is it not "allowed" to use .htm pages in my app, or am I doing something
wrong?

Regards Magnus

.htm and .html files are not handles by the asp(.net) parser so you can
request them without a problem.

To change this: rename the files to .aspx or let the htm(l) files being
parsed.

--

//Rutger

DoDotNet@KICKTHIS_Gmail.com
www.RutgerSmit.com