Prevent users from accessing XML files on the server through their browser addresses

Recently when doing a project, because many are called interfaces, so basically do not need the database, in order to save a small amount of validation data, the use of XML is chosen to store. after uploading the project to the server, it is found that the client can access the XML path on the browser by entering the server-side corresponding XML paths, because the XML contains information that uniquely identifies the user, so it does not want the user to be able to view the file, so it searches the web for several solutions.

programme One: encrypts the data in the XML. This approach is really simple, but it doesn't do what I want to prohibit users from accessing this file.

Scenario Two: Modify the XML file extension name, for example, change. xml to. Do. This method can also effectively prohibit user access, but my project in the XML references too much, the change is more cumbersome, so also have to look for the next solution.　　

Scenario Three: First add an XML map to IIS, the mapped program is C:\WINNT\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll

Then add the following code to the Web. config

<add verb= "*" path= "*.xml" type= "System.Web.HttpNotFoundHandler"/>

This allows the server to return a 404 (File not found) page when the user accesses the XML

This method seems to be a perfect solution to the problem I want to end, but! My \microsoft.net\framework\v1.1.4322 folder is empty, but found a v4.0.30319 this folder, thinking my is. NET Framework4.5, and then quoted, but found in the Web. config add code, page hints httphandlers This may be wrong, but how to change all no fruit, can only feel that the file was added wrong. So a good study of IIS, found the final solution.

Scenario four: In IIS, there is a request filtering, open look, there is a file extension, you can add the specified extension name inside, thereby prohibiting access to such files.

Want to go or the final Solution (scenario four) is relatively simple, but think about the data security perspective, or should be important data encryption after the data into the database or other data storage files.

　　　　　　

Prevent users from accessing XML files on the server through their browser addresses