IIS7和文件权限

Question

I have a text file in my virtual directory. My problem is that when a user gives the url for this file in a browser, its contents are returned. My web application is reading from and writing to it but I don't want to show it to user. How to set permissions of this file or configure IIS7 to achieve this task?

Answer 1

You can move the file out of your web site folder into a place like c:\\datafiles. Give the IIS account read/write access to it and then there is no way a web user can get it.

EDIT: Or you could change the extension to something that is not severed by IIS like .config

Answer 2

Also you can Remove the Read permission from IUSER account. for more security keep read and write permission for ASPNET MACHINE and SYSTEM.