I know that IIS7 allows me to have a per directory configuration with the web.config
xml file. I have a directory with some configuration files that don't want to be web accessible. A local web.config file forbidding read access to it would be a nice solution.
What should be the contents of a web.config file to forbid web access to the files?
Edit: I'm trying to put a web.config file with these contents in a file:
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<authorization>
<deny users="*" /> <!-- Denies all users -->
</authorization>
</system.web>
</configuration>
But I can still directly access a file inside the directory. What's wrong with it? How do I debug what's happening?
