security - IIS7, web.config to allow only static file handler in directory /uploads of website

Question

If it's possible which I think so, How do I modify my web.config to make a sub directory static -- files inside will only processed as static file, even if its name is "aspx" or something else? Thanks.

Answer 1

Add the following to a web.config file in the folder containing the files you wish to be served only as static content:

<configuration>
    <system.webServer>
        <handlers>
           <clear />
            <add 
                name="StaticFile" 
                path="*" verb="*" 
                modules="StaticFileModule,DefaultDocumentModule,DirectoryListingModule" 
                resourceType="Either" 
                requireAccess="Read" />
        </handlers>
        <staticContent>
            <mimeMap fileExtension=".*" mimeType="application/octet-stream" />
        </staticContent>
    </system.webServer>
</configuration>