asp.net - Deny access to html page

Question

I have ASP.NET Web Forms project. I created a folder Demo in this project and put in this folder HelloWorld.html. I need deny access to this html (it's important not asp) page for all users. How can I do this?

I tried this way, but it didn't work (but it works perfectly with asp page).

<configuration>
    <location path="Demo/HelloWorld.html">
        <system.web>
            <authorization>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>
</configuration>

Answer 1

Your web.config is correct. The problem is this secures files that are going through the ASP.NET pipeline. Certain static files, like html files, are served up directly by IIS and so it is bypassing your security.

You can force static files to go through the ASP.NET pipeline by adding a handler for them under the <system.webServer> section of your web.config:

<handlers>
    <add name="HTMLHandler" type="System.Web.StaticFileHandler" path="*.html" verb="GET"  />
</handlers>