Question

The application folders in ASP.NET are used for storing various elements critical to running a website. I want to get a handle on understanding these folders in more depth, specifically the folder accessibility. According to the article on ASP.NET Web Site Layout:

The content of application folders,
except for the App_Themes folder, is
not served in response to Web
requests, but it can be accessed from
application code.

Any browser request to these folders results in a “404 – Page Not Found.”

So what prevents folders like App_Code, App_Data, App_WebReferences, bin, etc. from being served to users? Is it an IIS hard coded “don’t serve this folder?” Is it a permissions configuration? And is there anyway to knowingly/unknowingly circumvent this?

Answer 1

On my IIS7.5 config, found at C:\Windows\System32\inetsrv\config\applicationHost.config there is this section:

<hiddenSegments applyToWebDAV="true">
    <add segment="web.config" />
    <add segment="bin" />
    <add segment="App_code" />
    <add segment="App_GlobalResources" />
    <add segment="App_LocalResources" />
    <add segment="App_WebReferences" />
    <add segment="App_Data" />
    <add segment="App_Browsers" />
</hiddenSegments>

See also IIS Documentation.