Lock IIS Bin

I had to deal in the last few days with a hard problem: My Hosting provider with ASP.NET support did not allowed me to use external dlls, did not allowed me to use dlls outside the appbase, did not allow me to use dlls outside the [Application name]/Bin directory.

Why this you ask? Well because i DO NOT WANT that people donwload "my precious" dll simply typing "http://mysite.com/Bin/myPrecious.dll"!!

Seen that i had the need to use several times the same dll i tried even to upload them only in one place.

I tried everything i could find, from loading the codeBase with "codeBase href" into the Web.Config (but that was blocked by the hosting), or adding "probing privatePath" directives... nothing worked.

I then found a simple solution to solve this thing (at least to block the access to the Bin directory) I know that better approach exists but i wasted too much time following the previous solutions :(

I added this after the <system.web> in the web.config

    <!-- BEGIN ADDED TO INHIBIT BIN ACCESS -->
    <authentication mode="Forms">
        <forms name="site" protection="All" loginUrl="~/some404.aspx"></forms>
    </authentication>
    <authorization>
        <allow users="?"/>
        <allow users="*"/>
    </authorization>
    <!-- END ADDED TO INHIBIT BIN ACCESS -->

And after the closures of </system.web> i added

<!-- BEGIN ADDED TO INHIBIT BIN ACCESS -->
<location path="Bin">
    <system.web>
        <authorization>
            <deny users="?"/>
            <allow users="*"/>
        </authorization>
    </system.web>
</location>
<!-- END ADDED TO INHIBIT BIN ACCESS -->

Now everything work as expeted (at least the Bin is forbidden!!!)

Last modified on: May 28, 2012