1

I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?

0

1 Answer 1

0

This question seems more to fit in stack overflow.

However you can remove those files by adding following to all my web.config files

<httpHandlers>
        <remove path="WebResource.axd" verb="GET"/>
        <remove path="WebResource.axd" verb="POST"/>
        <remove path="ScriptResource.axd" verb="GET"/>
        <remove path="ScriptResource.axd" verb="POST"/>
 </httpHandlers>

Now when you try to get these pages you might be prompted to login or given 404 error.

Also remove them from in

<system.webServer> 
     <handlers>
         <remove name="ScriptResourceIntegrated-4.0"/>
     </handlers>
</system.webServer> 

<location path="WebResource.axd">
 <system.web> 
<authorization>
 <deny users="*"/>
 </authorization> 
</system.web> 
</location>
5
  • <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location> //I can prevent public access to WebResource.axd file by using the above line of code in webconfig file. //But i am unable to do the same for ScriptResource.axd
    – Vinay D
    Apr 4, 2019 at 10:24
  • please check this. stackoverflow.com/questions/28856991/…. Also try URL rewriting.
    – Rohith K D
    Apr 4, 2019 at 10:29
  • <system.webServer> <handlers> <remove name="ScriptResourceIntegrated-4.0"/> </handlers> </system.webServer> above lines worked for me to prevent public access to ScriptResource.axd
    – Vinay D
    Apr 4, 2019 at 10:42
  • Thanks. I have updated the answer.
    – Rohith K D
    Apr 4, 2019 at 10:48
  • Add this as well <location path="WebResource.axd"> <system.web> <authorization> <deny users="*"/> </authorization> </system.web> </location>
    – Vinay D
    Apr 4, 2019 at 10:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.