I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?


This question seems more to fit in stack overflow.

However you can remove those files by adding following to all my web.config files

        <remove path="WebResource.axd" verb="GET"/>
        <remove path="WebResource.axd" verb="POST"/>
        <remove path="ScriptResource.axd" verb="GET"/>
        <remove path="ScriptResource.axd" verb="POST"/>

Now when you try to get these pages you might be prompted to login or given 404 error.

Also remove them from in

         <remove name="ScriptResourceIntegrated-4.0"/>

<location path="WebResource.axd">
 <deny users="*"/>
| improve this answer | |
  • <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location> //I can prevent public access to WebResource.axd file by using the above line of code in webconfig file. //But i am unable to do the same for ScriptResource.axd – Vinay D Apr 4 '19 at 10:24
  • please check this. stackoverflow.com/questions/28856991/…. Also try URL rewriting. – Rohith K D Apr 4 '19 at 10:29
  • <system.webServer> <handlers> <remove name="ScriptResourceIntegrated-4.0"/> </handlers> </system.webServer> above lines worked for me to prevent public access to ScriptResource.axd – Vinay D Apr 4 '19 at 10:42
  • Thanks. I have updated the answer. – Rohith K D Apr 4 '19 at 10:48
  • Add this as well <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location> – Vinay D Apr 4 '19 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.