I have an application on an IIS 7 server (GoDaddy shared Windows hosting). There is an xml file containing sensitive information which no page links to, but if the URL becomes known it could be accessed via the browser, and that is bad. I turned off GoDaddy's read permission on the folder, but the ASP.NET pages then cannot locate the file.
So far I've configured web.config (the base folder is configured with Forms Authentication) with
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
That does not seem to protect the file. I also have implemented an XSL stylesheet which will redirect the browser away from the file, but it is still possible to grab the contents using a program or script that won't put it through the stylesheet.
Any suggestions on how to completel ...
Go to the complete details ...