1

I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?

Improve this question
0

1 Answer 1

Reset to default
0

This question seems more to fit in stack overflow.

However you can remove those files by adding following to all my web.config files

<httpHandlers>
        <remove path="WebResource.axd" verb="GET"/>
        <remove path="WebResource.axd" verb="POST"/>
        <remove path="ScriptResource.axd" verb="GET"/>
        <remove path="ScriptResource.axd" verb="POST"/>
 </httpHandlers>

Now when you try to get these pages you might be prompted to login or given 404 error.

Also remove them from in 

<system.webServer> 
     <handlers>
         <remove name="ScriptResourceIntegrated-4.0"/>
     </handlers>
</system.webServer> 

<location path="WebResource.axd">
 <system.web> 
<authorization>
 <deny users="*"/>
 </authorization> 
</system.web> 
</location>
Improve this answer
6
  • <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location> //I can prevent public access to WebResource.axd file by using the above line of code in webconfig file. //But i am unable to do the same for ScriptResource.axd
    – Vinay D
    Apr 4, 2019 at 10:24
  • please check this. stackoverflow.com/questions/28856991/…. Also try URL rewriting.
    – Rohith K D
    Apr 4, 2019 at 10:29
  • <system.webServer> <handlers> <remove name="ScriptResourceIntegrated-4.0"/> </handlers> </system.webServer> above lines worked for me to prevent public access to ScriptResource.axd
    – Vinay D
    Apr 4, 2019 at 10:42
  • Thanks. I have updated the answer.
    – Rohith K D
    Apr 4, 2019 at 10:48
  • Add this as well <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location>
    – Vinay D
    Apr 4, 2019 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .