如何在 Web.Config 中禁用目录浏览
我有一个网站，并且希望从 web.config 文件中拒绝目录浏览器。
这里我使用的代码放置在根目录中。 不起作用。我正在本地测试它，因此使用类似 http://localhost:3214/ 的 URL，我仍然可以浏览 CMS 的目录。
- 我做错了什么？
- 它甚至应该在本地计算机上工作吗？
感谢您的支持！
<configuration>
<location path="Cms">
<system.webServer>
<directoryBrowse enabled="false" />
</system.webServer>
</location>
</configuration>
一些资源：
http://www.expta.com/2008/03/configuring-virtual-directories-with.html
I have a WebSite and I woud like Deny Directory Browser from a web.config file.
Here the code I'm using placed in the ROOT.
Does not work. I'm testing it Locally so with URL LIKE http://localhost:3214/ I can still browser the directory fro CMS.
- What I'm doing wrong?
- Should it work even on Local Machine?
Thanks for your support!
<configuration>
<location path="Cms">
<system.webServer>
<directoryBrowse enabled="false" />
</system.webServer>
</location>
</configuration>
Some resource:
http://www.expta.com/2008/03/configuring-virtual-directories-with.html
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
首先：并非所有内容都可以在
我找不到
system.webserver部分被定义为使用IgnoreSection处理程序：即。它不是由标准System.Configuration实现处理的，而是为尝试使用
directoryBrowse元素将web.config添加到Cms文件夹中，以确认浏览已被阻止。First: not everything works in a
<location>block.I cannot find a positive statement that
<system.webServer>isn't supported in a<location>, but I cannot find any cases where it is suggested that it is allowed. Evidence for this is in the (global)machine.configwhere thesystem.webserversection is defined to use theIgnoreSectionhandler: ie. it isn't processed by the standardSystem.Configurationimplementation, and it is that standard implementation of config handling that provides support for<location>.Try adding a
web.configinto theCmsfolder with thedirectoryBrowseelement to confirm that browsing is blocked.Gibbok，这里没有任何问题，不要惊慌:)
假设您正在从 Visual Studio 内的内置服务器浏览您的网站，这通常是正常情况。
我非常确定，如果您使用上述代码迁移到 IIS，目录浏览的行为将与您希望的一样。
尝试在 IIS 中托管此网站，并让我们知道发生了什么，谢谢。
Gibbok, nothing is wrong here, Don't panic :)
Assuming that you are browsing your website from the built-in server inside Visual Studio, This is typically a normal case.
I'm pretty sure that if you moved to IIS with the above code, Directory browsing will behave just like what you want it to be.
Give it a try and host this website in IIS, and let us know what happened, Thanks.
我正在尝试相同的代码。你所拥有的实际上是正确的。这是参考。
当然，它对我不起作用，我也不明白为什么，直到我读了理查德的帖子并记得有人在该目录中放置了一个 web.config 文件。该文件会覆盖主 web.config 文件中的行为。在子目录 web.config 中，directoryBrowse 选项被显式打开（以及很多其他处理程序，哎呀！）。删除该文件，上面的内容对我有用。它实际上将请求传递给下一个处理程序，这正是我想要的。
我在本地计算机上使用 IIS 7。
I was trying the same code. What you have is in fact correct. Here is the reference.
Of course it wasn't working for me and I couldn't figure out why, until I read Richard's post and remembered that someone put a web.config file in that directory. That file overrides the behavior in the main web.config file. In the sub directory web.config the directoryBrowse option was explicitly turned on (as well as a LOT of other handlers, yikes!). Delete that file and what you have above works for me. It actually passes the request along to the next handler, which is exactly what I wanted.
I'm using IIS 7 on my local machine.
<目录浏览>指令仅通过 http 协议控制目录列表：
http://msdn.microsoft.com/en -us/library/ms691327%28v=vs.90%29.aspx
它不会对代码产生任何影响，尝试从任何其他（甚至您自己的）应用程序中访问该目录。
@编辑：编辑后，如果我理解正确 - 我认为，您所说的“拒绝目录浏览器”的意思是预期的功能：使用浏览器显示指定路径内的目录内容。是的，它可能无法在本地开发服务器中工作。在 II 上试试吧！
the <directoryBrowse> directive controls the listing of the directory via the http protocol only:
http://msdn.microsoft.com/en-us/library/ms691327%28v=vs.90%29.aspx
It will not have any effect on code, trying to access the directory from within any other (or even your own) application.
@Edit: after the edit and if I get you right - I think, what you mean by Deny Directory Browser is the intended functionality: show the contents of the dir within a specified path using the browser. And yes, it probably will not work in the local development server. Try it on IIs!