IIS7 URL过滤

Question

I'm trying to denied access to my website when users use a URL like

https://www.mywebsite.com/./somepage.aspx

Right now when I try the url above IIS7 will serve:

https://www.mywebsite.com/somepage.aspx

I also installed urlscan on the server with

AllowDotInPath=0

[DenyUrlSequences]

..  ; Don't allow directory traversals
./  ; Don't allow trailing dot on a directory name
\   ; Don't allow backslashes in URL
:   ; Don't allow alternate stream access
%   ; Don't allow escaping after normalization
&   ; Don't allow multiple CGI processes to run on a single request

but it still allowing access :(

My way of testing it is using curl:

curl -I https://www.mywebsite.com/./somepage.aspx

What am i doing wrong?

Thanks in advances!

Answer 1

Set your web.config to deny access to all users for somepage.aspx and then allow only authorised users. This is done differently depending on whether you are using Windows Active Directory authorization or form authorization, but the concept is still the same.

On how to set the web.config, look here

On another note, why do you have a period in your url? is it for a current directory???