Stash serving up web.config files when using IIS as a reverse proxy

Chris Horton

I'm sure this is more of an IIS configuration issue, but I can't seem to find a solution.

I currently have Stash configured with IIS as a reverse proxy.  The problem I am experiencing is that if I try to look at the source of any web.config from a .Net project via stash, I receive a 404 error.

Due to the nature of web.config files I assume that there is a setting somewhere in IIS which prevents this sort of file being requested or returned as static content, but I can't seem to find a setting in IIS that would help resolve this issue.

Any suggestions or help would be greatly appreciated.

Chris Horton

I actually managed to find a solution to this issue.

Turns out that as suspected at a global level web.config files are filtered out by IIS.  This can be overridden on a site by site basis by adding the following to the sites web.config (in this case the base site that contains the reverse proxy configuration) 

<security>
   <requestFiltering>
      <hiddenSegments>
         <remove segment="web.config" />
      </hiddenSegments>
   </requestFiltering>
</security>

 

This article pointed me in the right direction: http://weblogs.asp.net/owscott/iis7-blocks-viewing-access-to-files-in-bin-and-other-asp-net-folders