Home > Configuration Reference > system.webServer > security > requestFiltering > fileExtensions > add

Adding File Name Extensions <add>

Overview

The <add> element of the <fileExtensions> collection specifies a unique file name extension to add to the collection of file name extensions for Internet Information Services (IIS) 7.

Note: When request filtering blocks an HTTP request because of a denied file name extension, IIS 7 will return an HTTP 404 error to the client and log the following HTTP status with a unique substatus that identifies the reason that the request was denied:

HTTP Substatus	Description
`404.7`	File Extension Denied

This substatus allows Web administrators to analyze their IIS logs and identify potential threats.

Compatibility

Version	Notes
IIS 7.5	The `<add>` element was not modified in IIS 7.5.
IIS 7.0	The `<add>` element of the `<fileExtensions>` collection was introduced in IIS 7.0.
IIS 6.0	The `<fileExtensions>` element replaces the IIS 6.0 UrlScan [AllowExtensions] and [DenyExtensions] features.

Setup

The default installation of IIS 7 includes the Request Filtering role service. If the Request Filtering role service is uninstalled, you can reinstall it using the following steps.

Windows Server 2008 or Windows Server 2008 R2

On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
On the Select Role Services page of the Add Role Services Wizard, select Request Filtering, and then click Next.
On the Confirm Installation Selections page, click Install.
On the Results page, click Close.

Windows Vista or Windows 7

On the taskbar, click Start, and then click Control Panel.
In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
Expand Internet Information Services, then World Wide Web Services, and then Security.
Select Request Filtering, and then click OK.

How To

Note for IIS 7.0 users: Some of the steps in this section may require that you install the Microsoft Administration Pack for IIS 7.0, which includes a user interface for request filtering. To install the Microsoft Administration Pack for IIS 7.0, please see the following URL:

http://www.iis.net/expand/AdministrationPack

How to deny access to a specific file name extension

Open Internet Information Services (IIS) Manager:
- If you are using Windows Server 2008 or Windows Server 2008 R2:
  - On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
- If you are using Windows Vista or Windows 7:
  - On the taskbar, click Start, and then click Control Panel.
  - Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
In the Connections pane, go to the connection, site, application, or directory for which you want to modify your request filtering settings.
In the Home pane, double-click Request Filtering.
In the Request Filtering pane, click the File Name Extensions tab, and then click Deny File Name Extension... in the Actions pane.
In the Deny File Name Extension dialog box, enter the file name extension that you wish to block, and then click OK.

For example, to prevent access to files with a file name extension of .inc, you would enter "inc" in the dialog box.

Configuration

Attributes

Attribute	Description
`allowed`	Required Boolean attribute. Specifies whether the file name extension is allowed or denied. Setting this attribute to true allows the Web server to process requests associated with these type files; setting this attribute to false prevents the Web server from processing requests. The default value is `true`.
`fileExtension`	Required string attribute. Specifies the name of the file name extension to allow or deny.

Child Elements

None.

Configuration Sample

The following example Web.config file will configure two options. It will configure request filtering to allow WebDAV access to all file name extensions, and it will configure IIS to deny access to files with a file name extension of .inc, which are sometimes used as include files for applications.

<configuration>
   <system.webServer>
      <security>
         <requestFiltering>
            <fileExtensions applyToWebDAV="false">
               <add fileExtension=".inc" allowed="false" />
            </fileExtensions>
         </requestFiltering>
      </security>
   </system.webServer>
</configuration>

Sample Code

The following code samples will add an entry to the list of file name extensions for the Default Web Site that will deny access to all files with an extension of .inc, which are sometimes used as include files for applications, and they will configure request filtering to allow WebDAV access to hidden segments.

Note: To use the same samples to allow access, you would set the value of the allowed attribute to true instead of false in each of these examples.

AppCmd.exe

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /fileExtensions.applyToWebDAV:"False"

appcmd.exe set config "Default Web Site" -section:system.webServer/security/requestFiltering /+"fileExtensions.[fileExtension='inc',allowed='False']"

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetWebConfiguration("Default Web Site");
         ConfigurationSection requestFilteringSection = config.GetSection("system.webServer/security/requestFiltering");

         ConfigurationElement fileExtensionsElement = requestFilteringSection.GetChildElement("fileExtensions");
         fileExtensionsElement["applyToWebDAV"] = false;
         ConfigurationElementCollection fileExtensionsCollection = fileExtensionsElement.GetCollection();

         ConfigurationElement addElement = fileExtensionsCollection.CreateElement("add");
         addElement["fileExtension"] = @"inc";
         addElement["allowed"] = false;
         fileExtensionsCollection.Add(addElement);

         serverManager.CommitChanges();
      }
   }
}

VB.NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration

Module Sample

   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetWebConfiguration("Default Web Site")
      Dim requestFilteringSection As ConfigurationSection = config.GetSection("system.webServer/security/requestFiltering")

      Dim fileExtensionsElement As ConfigurationElement = requestFilteringSection.GetChildElement("fileExtensions")
      fileExtensionsElement("applyToWebDAV") = False
      Dim fileExtensionsCollection As ConfigurationElementCollection = fileExtensionsElement.GetCollection

      Dim addElement As ConfigurationElement = fileExtensionsCollection.CreateElement("add")
      addElement("fileExtension") = "inc"
      addElement("allowed") = False
      fileExtensionsCollection.Add(addElement)

      serverManager.CommitChanges()
   End Sub

End Module

JavaScript

var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site";
var requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site");

var fileExtensionsElement = requestFilteringSection.ChildElements.Item("fileExtensions");
fileExtensionsElement.Properties.Item("applyToWebDAV").Value = false;
var fileExtensionsCollection = fileExtensionsElement.Collection;

var addElement = fileExtensionsCollection.CreateNewElement("add");
addElement.Properties.Item("fileExtension").Value = "inc";
addElement.Properties.Item("allowed").Value = false;
fileExtensionsCollection.AddElement(addElement);

adminManager.CommitChanges();

VBScript

Set adminManager = WScript.CreateObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST/Default Web Site"
Set requestFilteringSection = adminManager.GetAdminSection("system.webServer/security/requestFiltering", "MACHINE/WEBROOT/APPHOST/Default Web Site")

Set fileExtensionsElement = requestFilteringSection.ChildElements.Item("fileExtensions")
fileExtensionsElement.Properties.Item("applyToWebDAV").Value = False
Set fileExtensionsCollection = fileExtensionsElement.Collection

Set addElement = fileExtensionsCollection.CreateNewElement("add")
addElement.Properties.Item("fileExtension").Value = "inc"
addElement.Properties.Item("allowed").Value = False
fileExtensionsCollection.AddElement(addElement)

adminManager.CommitChanges()

Configuration Settings

View by Schema

Deprecated Elements