Hi all, I'm just working on locking down IIS7 with request filtering.
To avoid any misunderstanding here it is the requestFiltering node from my applicationHost.config file:
<requestFiltering allowHighBitCharacters="false" allowDoubleEscaping="false">
<requestLimits maxAllowedContentLength="30000000" maxUrl="260" maxQueryString="50" />
<fileExtensions allowUnlisted="false" applyToWebDAV="false">
<add fileExtension=".svc" allowed="true" />
<add fileExtension=".aspx" allowed="true" />
<add fileExtension=".jpg" allowed="true" />
<add fileExtension=".gif" allowed="true" />
<add fileExtension=".png" allowed="true" />
<add fileExtension=".zip" allowed="true" />
</fileExtensions>
<verbs allowUnlisted="false" applyToWebDAV="false">
<add verb="GET" allowed="true" />
<add verb="POST" allowed="true" />
</verbs>
<hiddenSegments applyToWebDAV="true">
<add segment="web.config" />
<add segment="bin" />
<add segment="App_code" />
<add segment="App_GlobalResources" />
<add segment="App_LocalResources" />
<add segment="App_WebReferences" />
<add segment="App_Data" />
<add segment="App_Browsers" />
</hiddenSegments>
<denyUrlSequences>
<add sequence=".." />
</denyUrlSequences>
</requestFiltering>
Setting allowUnlisted="false" in the fileExtensions node, causes my root site not to serve anymore the default document. That is, if I browse for http://www.mysite.com I receive a 404 not found, being the request for / blocked by the request filtering file extensions rule, although I configured the default document to default.aspx.
Despite, browsing for http://www.mysite.com/default.aspx everything works fine.
Confirmation comes when changing just allowUnlisted="true" in the fileExtensions node: in this case the default document is served by IIS, according to the configuration.
I'm thinking this could be solved with some particular entry in the fileExtensions section. Can someone help me on this please?
You should agree that for end-users using a short url (www.mysite.com) is much more confortable and user-friendly than having to type a "complex" URL with the home document.
Thank you in advance,
Regards,
Davide