Block access to a specific folder in your ASP.NET MVC website

One way to block access to a specific folder in your ASP.NET MVC website is by combining the <location> with an <authorization> section inside your web.config:

	<configuration>
	<location path="hiddenfolder">
	<system.web>
	<authorization>
	<deny users="*"/>
	</authorization>
	</system.web>
	</location>
	</configuration>

view raw web.config hosted with ❤ by GitHub

In fact this is not the best approach as it is possible that this configuration is not applied when the ASP.NET pipeline is not invoked.

A better approach is to block the access at the IIS level by using the following configuration inside your web.config:

	<system.webServer>
	<security>
	<requestFiltering>
	<hiddenSegments>
	<add segment="hiddenfolder" />
	</hiddenSegments>
	</requestFiltering>
	</security>
	<system.webServer>

view raw web.config hosted with ❤ by GitHub