URL authorization and file types related to nonAsp.Net

This is because of the maps script for ASP.NET. Only certain extensions appear in ASP.NET. The rest are handled directly by IIS. This is by design, for performance reasons.

There are two ways to handle this.

• Duplicate your authorization rules in the web.config files in the ACL files of the NTFS files (that is, set the permissions to the folders and files directly). Make sure the user authentication scheme matches the accounts and groups used for access control ... in other words, if you are using SQL to store username tokens, this will not work because those tokens will not necessarily be mapped back to domain users and groups / roles.

• Create an IHttpHandler to serve your nonASP.NET files. From the method, ProcessRequest
  
  call the method Server.MapPath(url)
  
  on the incoming url and then release the file with Response.WriteFile(filename)
  
  . You probably need to set the ContentType property first. And (here's the bad news), you may still need declarative or mandatory access checks - just having entries in your web.config files might not work. See Custom ASP.NET Handling with HTTP for more information on writing your own handler. It's probably a good idea to make separate handlers for each content type. Once you've written one, you'll see how easy it is to make them.

You can try (haven't tried it yourself) to add <httpHandlers> elements to your web.config files where you have additional <authorization> elements - use the <remove> element to remove the inherited HttpHandler and add another one at the subfolder level (maybe pointing to the same class?). I'm not sure if this will work, but it's worth a try.

Finally, if you really don't want to go through and do all this work, you can simply add additional extensions to IIS. For example, see How to Register HTTP Handlers , you can add a .jpg file mapping to aspnet_isapi.dll (take a look at existing mappings for .aspx, etc.). You don't need to add the HttpHandler element to your web.config because the machine level web.config already contains this entry:

<add path="*" verb="GET,HEAD,POST" type="System.Web.DefaultHttpHandler" validate="true"/>

      

        
        
        
      

    

Please note that your site may experience severe performance issues.