Deny Folder and direct link access in .NET MVC

Question

I have the following code in the Web.config file

<location path="UserContent">
    <system.web>
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
</location>

It denies access to the specified folder and sub-folders but direct link access to files is still possible. How can I fix it?

Thanks

Answer 1

Add this to <system.webServer>

<security>
  <requestFiltering>
    <hiddenSegments>
      <add segment="UserContent"/>
    </hiddenSegments>
  </requestFiltering>
</security>

This will prevent anyone from accessing the folder, sub-folders and static files.