Stash serving up web.config files when using IIS as a reverse proxy

[Chris Horton]

I'm sure this is more of an IIS configuration issue, but I can't seem to find a solution.

I currently have Stash configured with IIS as a reverse proxy.  The problem I am experiencing is that if I try to look at the source of any web.config from a .Net project via stash, I receive a 404 error.

Due to the nature of web.config files I assume that there is a setting somewhere in IIS which prevents this sort of file being requested or returned as static content, but I can't seem to find a setting in IIS that would help resolve this issue.

Any suggestions or help would be greatly appreciated.

[Chris Horton · Accepted solution]

I actually managed to find a solution to this issue.

Turns out that as suspected at a global level web.config files are filtered out by IIS.  This can be overridden on a site by site basis by adding the following to the sites web.config (in this case the base site that contains the reverse proxy configuration) 

<security>
   <requestFiltering>
      <hiddenSegments>
         <remove segment="web.config" />
      </hiddenSegments>
   </requestFiltering>
</security>

This article pointed me in the right direction: http://weblogs.asp.net/owscott/iis7-blocks-viewing-access-to-files-in-bin-and-other-asp-net-folders

[ThiagoBomfim]

Awesome! Thanks for sharing your solution.

[kibka256]

Thanks, worked for me!

[ThiagoBomfim]

Hi Chris,

Have you gone through https://support.microsoft.com/en-us/kb/248033 ?

Best,
Thiago