How to restrict anonymous users authorization for whole site collection for _vti_bin folder

Question

Hi, We enable the feature ViewFormPagesLockDown and also modify the Web.config file with the following XML element: but we have many sub sites and below configuration only applicable to certain site path only, for example if i have subsite /en/news/_vti_bin/spsdisco.aspx below configuration not work.

<location path="_vti_bin">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>

How to restrict anonymous users authorization for whole site collection for _vti_bin folder.

Answer 1

Here are similar issues for your reference:
https://social.technet.microsoft.com/Forums/office/en-US/15dba2d5-152d-4e27-9a19-31df8ed3c93e/is-it-possible-to-lock-down-the-vtibin-and-layouts-pages-with-a-wildcard-option?forum=sharepointadminprevious
https://sharepoint.stackexchange.com/questions/167264/restricting-access-to-contents-in-vti-bin-for-both-authenticated-as-well-as-a
As trevor said, many pages may need to call these services. It is not recommended to restrict access. If this is necessary, you may only add configuration for each subsite.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.