Discussions about IIS6 Wildcard Issues?

Question

We strive to use URLs without continuing for the first time in our organization. We asked our sys administrators to add wildcard matching in IIS6 so that all requests are handled through asp.net. They push back, citing security concerns. I don’t have enough information about potential wildcard matching security issues to find out what kind of security issues it can or cannot create. Any feedback would be appreciated.

Answer 1

Basically, adding a wildcard mapping in IIS6, then ALL requests will be processed through the .net infrastructure. I'm not sure about security issues, but I know that a lack of performance has never been verified

see link text

Answer 2

The big problem, I suspect, is that most types of administrators are afraid of what they don’t understand. They are IIS grok, but the entire ASP.NET pipeline is a stranger. Ask them to document their problems, then you can shoot them down one by one.

, , ( ).

Answer 3

, .NET, IIS. , , .

, , , , - .NET, . .NET . HttpModule web.config, , ( , ).

- , , - .

Answer 4

, , .exe, , IIS ISAPI.

If you have .exe, bat, or other executable files anywhere in the IIS path, any user can execute them.

If you carefully configure IIS sites and virtual directories to not contain anything that could be used maliciously, then you should be fine.