Security Tip: Blocking Access to ASP.NET MVC Views Using Alternative View Engines

When you create a new ASP.NET MVC project using our default templates, one of the things you might notice is that there is a web.config file within the Views directory. This file is there specifically to block direct access to a view. Let�s look at the relevant sections. For IIS 6 (and Cassini) < add path ="*.aspx" verb ="*" type ="System.Web.HttpNotFoundHandler" /> For IIS 7 < add name ="BlockViewHandler" path ="*.aspx" verb ="*" preCondition ="integratedMode" type ="System.Web.HttpNotFoundHandler" /> What these sections do is block all access to any file with the .aspx extension within the Views directory (or subdirectories). Note that access is blocked...(read more) ...