Re: how does the app_data folder work
- From: "Juan T. Llibre" <nomailreplies@xxxxxxxxxxx>
- Date: Mon, 10 Sep 2007 12:16:04 -0400
re:
!> is app_data a reserved name for IIS and ASP.Net
No, it's not.
The files which are not served are set in the master web.config file, in the
<httpHandlers> section, managed by System.Web.HttpForbiddenHandler.
That m,aster web.config file is located at :
drive:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config
Examples :
<add path="*.mdb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
<add path="*.ldb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
<add path="*.mdf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
<add path="*.ldf" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />
You can add any other file extensions you don't want
ASP.NET to serve directly by following that format.
re:
!> is there some jiggery pokery going on behind the scenes with file permissions or virtual roots?
There's also some jiggery pokery going on behind the scenes with file permissions or virtual roots.
If you create a Web site in Visual Web Developer (whether the standalone or the VS IDE),
VWD creates a folder named App_Data below the current root folder.
The folder is designed to be a store for application data of any type.
The App_Data folder is also used by ASP.NET to store databases that the system maintains,
such as the database for membership and roles.
When VWD creates the App_Data folder, it grants Read and Write permissions
for the folder to the ASPNET or NETWORK SERVICE user account.
So, if a request is made from an external browser for a forbidden file,
the account requesting it won't be the ASPNET or NETWORK SERVICE accounts,
which are the only ones which are allowed access to those files.
There's no "unexplained magic" involved.
It's all pretty much straightforward.
Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
======================================
"Andy Fish" <ajfish@xxxxxxxxxxxxxxxx> wrote in message news:uKpdqy78HHA.980@xxxxxxxxxxxxxxxxxxxxxxx
Hi,
From what I can gather, under Asp.Net 2.0, it is safe to put data and config files underneath the app_data in the web
root and they will not be served directly to the browser from a URL.
Can anyone explain just how this feature works. is app_data a reserved name for IIS and ASP.Net, or is there some
jiggery pokery going on behind the scenes with file permissions or virtual roots?
It's not that I don't trust Microsoft; it's just that .... well.... I guess I don't trust Microsoft - especially where
bits of unexplained magic are concerned :-)
TIA
Andy
.
- Follow-Ups:
- Re: how does the app_data folder work
- From: Andy Fish
- Re: how does the app_data folder work
- References:
- how does the app_data folder work
- From: Andy Fish
- how does the app_data folder work
- Prev by Date: Re: ie7 displaying only half of page (cuts page in half)...
- Next by Date: Re: Access hidden asp.net objects
- Previous by thread: how does the app_data folder work
- Next by thread: Re: how does the app_data folder work
- Index(es):
Relevant Pages
|
