I am attempting to get a relatively simple ASP.NET 2.0 intranet site up and running on IIS 6.0. One very specific security requirement I have to operate under is the execute permissions on the root directory of the site MUST be set to None. All of my .aspx, .cs, etc. files are in a \scr directory (which has "scripts only" permission) and the root directory contains a Default.htm page that redirects immediately to /scr/Default.aspx. I am having a lot of trouble making this work due to the way ASP.NET utilizes the WebResource.axd handler to get Java Script resources. Apparently scripts permissions on the root directory are required for WebResource.axd to work correctly because everything works fine when I allow scripts to run in root. When I turn off scripts on root everything breaks. I am also utilizing some .rdlc files to display reports and they are utilizing the reserved.reportViewerWebControl.axd handler which appears to work ... Go to the complete details ...

Found interesting? Add this to: