c# - Denying file extensions in IIS -

in iis noticed can deny access file extension on server. example, deny access .jpg images. browser won't b e able display .jpg images on site.

i wondering, iis allow deny access file extensions - or filenames- being accessed directly (by typing full url address bar), while still serving them browser if being requested document?

you can't really prevent doing this; determined person can download webpage can download. however, can make more difficult less technically literate checking http referrer in request. if it's url of 1 of webpages, can allow request. otherwise, can deny it. technique used prevent deep linking quite often.

here's sample (untested) of how can .net http module:

public class imagedenyingmodule : ihttpmodule {     public void init(httpapplication app)     {         app.beginrequest += (s, e) => {             var request = app.context.request;             if (requirespagereferrer(request.url) && !isvalidreferer(request.urlreferrer)) {                 app.context.response.statuscode = 404;                 app.context.response.end(); // or something...             }         };     }      private bool requirespagereferrer(string url) {     }      private bool isvalidreferrer(string referrer) {     } }