asp.net - How to disable Directory Browse in Web.Config

Question

I have a WebSite and I woud like Deny Directory Browser from a web.config file.

Here the code I'm using placed in the ROOT. Does not work. I'm testing it Locally so with URL LIKE http://localhost:3214/ I can still browser the directory fro CMS.

• What I'm doing wrong?
• Should it work even on Local Machine?

Thanks for your support!

<configuration>
  <location path="Cms">
    <system.webServer>
      <directoryBrowse enabled="false" />
    </system.webServer>
  </location>
</configuration>

Some resource:

http://blogs.iis.net/bills/archive/2008/03/24/how-to-enable-directory-browsing-with-iis7-web-config.aspx

http://www.expta.com/2008/03/configuring-virtual-directories-with.html

Answer 1

First: not everything works in a <location> block.

I cannot find a positive statement that <system.webServer> isn't supported in a <location>, but I cannot find any cases where it is suggested that it is allowed. Evidence for this is in the (global) machine.config where the system.webserver section is defined to use the IgnoreSection handler: ie. it isn't processed by the standard System.Configuration implementation, and it is that standard implementation of config handling that provides support for <location>.

Try adding a web.config into the Cms folder with the directoryBrowse element to confirm that browsing is blocked.