Question

The server is IIS7.

Is there a way to disable web.config files in subfolders?

I am asking because, I have a folder on the web server that is for uploads. When someone uploads files, a new folder is created for the user’s session and the files they upload go in the folder.

So the path to uploads would be like this:
~/uploads/3F2504E0-4F89-11D3-9A0C-0305E82C3301/somefile.txt

In the ~/uploads/ directory there is a web.config file that removes all http handlers except the static file handler and adds a wildcard mime type. So every file that a user uploads will only ever be served statically.

If a user uploads a web.config file, I want to disallow any of the settings in that file from being applied.

How can I do this?

EDIT

Could I just make the upload folder an application that is a member of an application pool configured to run in Classic mode instead of Integrated Pipeline mode? That way it wouldn’t even care about a web.config file.

EDIT 2

Is there another type of webserver I could install for serving all files statically? I could just access the files through a different port. Is there some software that I can be sure wont run any scripts and is safe.

Answer 1

Ok I have a different angle on this…

What if your uploads folder was not part of the website and instead part of the file system? This way ASP.NET is not processing requests to the folder and thus web.config wouldn’t be loaded by the ASP.NET runtime.

You’d have to give your app pool’s account read/write access to the file system where these files are stored, but I think it better fits what you’re trying to accomplish.