IIS 服务器：限制用户访问服务器文件

Question

I have one server, which allows users to host their web app free of cost.

In server I have 4 different pools.

2 pools are for.Net Framework, 1 pool is for.Net MVC, 1 pool is for.Net Core 3.1

Each pools has 50+ appliations.

For security testing I have created one program, Which takes fullpath/location of file and read that file form IIS server. If any user upload that type of code in my server then they can assess any files.

Now, that is the issue with my server.

Now, I want to do, My users can access only their application resources not other's too.

But, I don't know how to do this.

Answer 1

In order to restrict users to access files in IIS, we could refer to the below configuration in root web.config file.

<location path="myfolder">
<system.webServer>
    <security>
        <authorization>
            <remove users="*" roles="" verbs="" />
         <!--for authentication, we should enable either windows authentication or form authentication in IIS authentication module.-->
            <add accessType="Allow" roles="Administrators" />
        </authorization>
    </security>
</system.webServer>
</location>

It will restrict everything under Myfolder . In particular, rule out a specific file.

     <location path="my.jpg">
     <system.webServer>
         <security>
             <authorization>
                 <remove users="*" roles="" verbs="" />
                 <add accessType="Allow" roles="Administrators" />
             </authorization>
         </security>
     </system.webServer>
 </location>

Feel free to let me know if there is anything I can help with.