Extensionless MVC and IIS 8 request filtering

Question

I am using IIS 8 on Server 2012 and have an MVC website serving extensionless pages. I'm trying to harden IIS by blocking all but an allowed set of extensions in the request filtering section. As extensionless MVC pages have no extension, this is proving somewhat difficult!

I've tried adding .mvc, .aspx and .cshtml to the allowed list to see if any of those would work but by unticking Allow unlisted file name extensions in the Edit Feature Settings menu, I keep getting a 404 error.

Is there any combination of special characters or some kind of keyword I can use to add extensionless addresses to the allowed list so that I can block all unlisted extensions? I really dont want to have to allow unlisted file name extensions and then create a list of hundreds of denied extensions.

Cheers all!

Is my answer helpful? If so feel free to accept and/or upvote ше if, or provide a feedback so I could improve it. Otherwise this thread looks abandoned and kinda useless for further readers. Thank you! — Alexander Abakumov
– Alexander Abakumov, Commented Sep 21, 2018 at 14:20

Alexander Abakumov · Accepted Answer · 2015-12-11 17:22:02Z

13

Sure. To allow extensionless adresses, add <add fileExtension="." allowed="true" /> to your web.config as below:

  <system.webServer>
    <security>
      <requestFiltering>
        <fileExtensions allowUnlisted="false">
          <add fileExtension="." allowed="true" />
        </fileExtensions>
      </requestFiltering>
    </security>
  </system.webServer>

Let me know if this helped.

edited Dec 11, 2015 at 17:22

answered Oct 5, 2014 at 13:53

Alexander Abakumov

14.7k16 gold badges99 silver badges135 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Extensionless MVC and IIS 8 request filtering

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related