2

Our security team at work did a security scan of our soon-to-be-deployed website and one of the items that was found was "Hidden Directory Detected". It shows up for 3 different folders, aspnet_client, scripts, and content.

The software recommends to throw a 404 instead of a 403, or to remove the folders completely. First, are the folders actually needed? How can I determine which folders in my visual studio project are actually needed in order for the site to actually run (without removing folders one-at-a-time and trying to access the site)?

What is the proper way to handle this/resolve the security scan alert? Do I need to add special routing rules in the routeconfig.cs for when these paths are accessed?

Edit, I should note that this is WebApi/REST service, not a regular MVC site. (Therefore, using the CustomErrors configuration section will not work)

  • Visual Studio has a "Publish" command that might be useful. Create a temp folder on your desktop & configure publish to use it & only copy what it thinks it needs. – Dan Pichelman Jul 17 '14 at 13:56
  • @DanPichelman thanks for the response. We are already using a TFS build server to publish and deploy. Having said that, does that mean everything that TFS is building and deploying is truly required in order to make the site run? – ganders Jul 17 '14 at 13:58
  • You should exactly set the technologies you are using. "The software recommends..." - What software? How does it recommend anything? – Gangnus Jul 17 '14 at 14:05
  • @Gangnus the security scanning software...based on the rules that it has for each test it performs, it has canned recommendations for the fix. – ganders Jul 17 '14 at 15:14
0

After much googling, here's the solution that I have implemented. I'm not sure if it's the best practice for this sort of thing, but it's working in my scenario.

Scroll down to the answer about implementing the NoAccessHandler : IHttpHandler

http://forums.asp.net/t/1478217.aspx?Make+IIS+return+a+404+status+code+instead+of+403

Config section needed:

<httpHandlers>
      <add verb="*" path="docs/*" validate="false" type="MyNameSpace.NoAccessHandler"/>
</httpHandlers>


<system.webServer>
        <handlers>
      <add name="NoAccess" verb="*" path="docs/*"  preCondition="integratedMode" type="MyNameSpace.NoAccessHandler"/>
    </handlers>
</system.webServer>

And the Handler code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

namespace MyNameSpace
{
    public class NoAccessHandler: IHttpHandler
    {

        #region IHttpHandler Members

        public bool IsReusable
        {
            get { return true; }
        }

        public void ProcessRequest(HttpContext context)
        {
            context.Response.StatusCode = 404;
        }

        #endregion
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.