File access restriction

Question

Hi.
I have a text file in my host root and I want to use it in my web application via my program but I want that clients can't see it directly, for example when they request "www.MyDomain.com\textFile.txt" an exception occurs.
How can I do that?
Thanks

John Penn · Answer

If you're using IIS7 you can block access to files by extension with the Request Filtering feature.

Zoran Horvat · Answer

Disabling directory browsing does not help you from accessing the file if you know its name and it's by default disabled for security reasons anyway. Zoran

Suthish Nair · Answer

Disable Directory browsing from IIS.

Zoran Horvat · Answer

That might be much harder solution and still you must be the sole owner of the Web server. If you decide to host the Web site at the hosting company your solution won't be applicable. Zoran

Majid Kamali · Answer

Can I use http handler? I mean I create a handler that runs for every file request from my site then if requested file is what I don't want to show to client I show an exception page to client.

Zoran Horvat · Answer

Majid Direct way to do that is to restrict users which can access the file. However if you're not owning the server but your website is hosted by some company this won't work because you typically won't be able to change settings. Hence you have to work around the problem and here are couple of thoughts that I've got how to do this: 1. Create dynamic page (ASP ASP.NET PHP...) which generates empty HTML in response but inside it has a huge comment block which actually contains data you wanted to have. You can format comment lines so that every line starts with specific word. Then from your application ignore all other lines and remove that word from the beginning of every useful line to get pure data. 2. Use some of the HTTP special characters in file name which are allowed in file systems. I have thought of # as one option so you might call your file some#thing.txt. However this solution can be broken if encoded URL is used (you can access such file from Web as some%23thing.txt). Consequently if you don't have access to the IIS (or whatever Web server it is) and you can't set up access rights yourself then I'd suggest you solution #1 and that is to create active file which would generate empty response if accessed. Since visitors have no means of reading server-side script source code they can't see the comments either and your data are safe. Zoran

John Penn · Answer

What is the exception you're getting? Can you post it here?