I'm going to deploy a pivotviewer application.

As some of you might know this silverlight application load a .cxml index file for a group of images.

My need is to make .cxml file and image files not accessible for the user.

Now, if I don't have a need I usually code like this in C# and the file is hosted in the documentroot:

_cxml = new CxmlCollectionSource(new Uri("http://www.myurl.it/Collection.cxml", UriKind.Absolute));

This means that my cxml and then the images are available by http for everyone who knows the URI.

I'm a newbie to server configuration, so any help/hint would be deeply appreciated.

Someone suggested me to take the files out of the root, but it seems like I can't go to pick them up if they are not a URL in Silverlight. At least I didn't managed to understand how.

Someone else suggested me to play with web.config file to hide URLs, but I don't really know where to start.

My question is, what's the best practice to hide my stuff?

Obviously I can edit the question if you need more details.