The website ignores System.Web.HttpForbiddenHandler and allows the loading of web.config

Question

My website allows you to download the web.config file. However, in my file C: \ WINDOWS \ Microsoft.NET \ Framework \ v2.0.50727 \ CONFIG \ web.config I have this line

<add path="*.config" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>

This means that any configuration file cannot be loaded.

What am I missing?

Answer 1

This is not a solution, but most of the work: I ended up setting the file to "hidden" on Windows and encrypted web.config ... just in case.

By setting it to hidden, the web server does not serve it, but it can still be used by asp.net to run it.