I'm investigating the use of extension filtering to lock down a web site. The site uses the MVC framework (v2). What I would like to do is block everything at the root of the web site:
<configuration>
<system.webServer>
<security>
<requestFiltering allowDoubleEscaping ="false" allowHighBitCharacters="false">
<fileExtensions allowUnlisted="false">
<clear/>
</fileExtensions>
...
And then add a directory under the root (say /web) and allow anything:
<configuration>
<system.webServer>
<security>
<requestFiltering allowDoubleEscaping ="false" allowHighBitCharacters="false">
<fileExtensions allowUnlisted="true">
</fileExtensions>
...
The web directory would be empty, ...
Go to the complete details ...