Security of APP_Data Folder in ASP.NET

Question

My Microsoft Access DB file is in APP_DATA folder. my server is Windows 2003 and I like to know how is the best way to protect this file.

so which one is safer ?

./wwwroot/App_data/Database.mdb

or

./db/Database.mdb

Mccready

Answer 1

Both methods are safe in the sense that the file won't get served to a remote client (unless you create a virtual path to the db folder. Files not served from a site are governed by the httpHandlers section in web.config:

<add path="*.mdb" verb="*" type="System.Web.HttpForbiddenHandler" validate="True" />

Any file type added here with type=HttpForbiddenHandler will not be served.

Where to put the Access file is a matter of taste and access. If you put it outside of your site i.e. in the db folder you will have to set up permissions for the application account you're using for your site/app. Placing it within the App_Data folder you're set to go. Also, if you're in a hosting environment you might not be able to place you're Access file outside of the site folder.

My 2 cents: go for the App_Data folder.

.håkan

Tootsy

Answer 2

Visitors cant download your mdb file, if mdb file in App_Data folder. But visitors can download your mdb file, if mdb file in db folder.

If you want to put your mdb file in db folder, you have to set securty permission for this folder.

Jacobi

db folder is not inside wwwroot, so I think they cannot download it. – Mccready

Yes, you are right... Sorry. From MSDN: App_Data folder Contains Microsoft Access databases (.mdb files), XML files, and other data stored in local files. The user account that is used to run the application (for example, the local ASPNET account) has permissions to read, write, and create files in this folder. Various ASP.NET application features, such as the providers for membership and roles, as well as the Web Site Administration Tool, are configured to work with the App_Data folder specifically. msdn.microsoft.com/en-us/library/f7fb46ye(v=vs.80).aspx – Jacobi

I think I have to add this to web.config <add path=".mdf" verb="" type="System.Web.HttpForbiddenHandler" validate="true" /> – Mccready