Unchecked 'Allow Unlisted File Name Extensions' and Adding required extensions cause site failure

Question

Hello Here,

I have to set up security feature in IIS to only allow certain extensions to work. Therefore, I unchecked "Allow unlisted file name extensions" in the Request Filtering settings. I, then, added all the files extensions that are required for the site to work. The site still failed to load.

Thank you for your help in advance.

Answer 1

Hello Gildas,

Thank you for your question and for reaching out with your question today.

If you have unchecked "Allow unlisted file name extensions" in the Request Filtering settings in IIS and added all the required file extensions, but the site still fails to load, there could be a few reasons for this:

1. Incorrect configuration: Double-check the configuration of the file extensions in the Request Filtering settings. Ensure that you have added the correct extensions and that they are entered correctly. Verify that there are no typos or missing characters.
2. MIME types: In addition to allowing file extensions, IIS also relies on MIME types to determine how to handle different file types. Make sure that the MIME types for the allowed file extensions are configured correctly. You can manage MIME types in IIS Manager under the "MIME Types" feature.
3. Application configuration: The issue may not be related to the Request Filtering settings but could be caused by the application configuration itself. Verify that the application is properly configured to handle the specified file extensions. Check the application's web.config file or any other relevant configuration files to ensure that the necessary settings are in place.
4. File permissions: It's possible that the site fails to load due to file permission issues. Ensure that the necessary files and directories have appropriate permissions set so that the web server can access them. Check the permissions on the files and directories involved in serving the site.
5. Application pool configuration: Check the configuration of the application pool associated with the site. Ensure that the application pool is running and configured correctly, including the .NET framework version, pipeline mode, and identity settings.
6. Server restart: After making changes to the Request Filtering settings or other configuration settings, it's a good idea to restart the IIS server or at least recycle the application pool to ensure that the changes take effect.

If you have checked all the above factors and the site still fails to load, it may be helpful to review the IIS logs or error logs to gather more information about the specific error or issue that is occurring. The logs can provide details about any errors or exceptions that are being encountered during the request processing.

If you are unable to resolve the issue, consider providing more specific details about the error message or behaviour you are experiencing, as well as the configuration of your site and server, so that further assistance can be provided.

I used AI provided by ChatGPT to formulate part of this response. I have verified that the information is accurate before sharing it with you.

If the reply was helpful, please don’t forget to upvote or accept as answer.

Best regards.

Answer 2

Hello Gildas,

make sure your are in an extension named URL application ex: http://sample.com/index**.html or** http://sample.com/default**.aspx** , what I mean here is if the URL ends with extension but if you are in extensionless application ex: MVC this will not work and you have to add the below line in your web.config

 <security>
        <requestFiltering>
			<fileExtensions allowUnlisted="false">
                           <add fileExtension="." allowed="true" /> 
			</fileExtensions>
        </requestFiltering>
 </security>

below URLs for more info

https://serverfault.com/questions/396229/what-file-extensions-must-be-allowed-in-request-filtering-when-using-asp-net-mvc

https://stackoverflow.com/questions/7039680/meaning-of-path-attribute-on-handlers-in-web-config

If the reply was helpful, please don’t forget to upvote or accept as answer.

Answer 3

Not sure of your code example but this is what I tried and what I got as a result.