Prevent aspx file run in upload folder

Question

I'm trying to protect me from ASPX Spy attacks.

I added the configuration in the web.config in my upload directory:

<configuration>
    <system.web>
      <authorization>
        <deny users="*" />
      </authorization>
    </system.web>
</configuration>

But, I can still run aspx files!

What am i missing?

Answer 1

EDIT:

the web.config section authorizes only URL not file execution. See this link to MSDN for more details

Answer 2

Try the following settings inside configuration which will prevent any type of file execution in upload folder:

<location path="upload" allowOverride="false">
 <system.webServer>
    <handlers>
       <clear />
        <add 
            name="StaticFile" 
            path="*" verb="*" 
            modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" 
            resourceType="Either" 
            requireAccess="Read" />
    </handlers>
    <staticContent>
        <mimeMap fileExtension=".*" mimeType="application/octet-stream" />
    </staticContent>
</system.webServer>