How to prevent certain file types from being served by IIS

How to prevent certain types of files from being served by the server (IIS)?

1)       In web.config, under the httpHandlers section (which is under system.web section, add the below:

<add verb="*" path="*.blah" type="System.Web.HttpForbiddenHandler"/>

2)       Using the IIS managment console, add a new application extension mapping for *.blah

a.        Go to IIS control panel

b.       Expand the webiste, go to the desired web app using the IIS mngment console, e.g. it may be located at c:\inetpub\wwwroot\MyWebApp1

c.        Go to the properties of that webiste

d.       Go to the "Directory" tab

e.       Click the "configuration" button, this should open up a new dialog window

f.         Copy the executable path (dll) for the .aspx mapping, usually located at:
c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll

g.        Click on "add" button to add new type of mapping for our file type, e.g. *.blah

h.       Paste the dll location for the aspnet engine(handles aspx pages)

i.         type ".blah" (without the quotes) in the extension text area (this can be replace with any file extension eg: js/html/PDF)

j.         while still in the "add/edit application extension mapping" window click the "limit to" radio button and type "GET,HEAD,POST,DEBUG"

k.        ensure that the "script engine" radio button is selected but not the "verify the file exists" radio button

asp.net - How to add an HttpHandler to replace a folder or page

Lets say you wanted to replace the static config.xml file from a certain folder in your web app with some dynamically served data. For example, custom config xml based on the logged in user's role. This could be done easily with asp.net's httphandlers.
Steps:

1. create a HttpHandler to serve your data based on who is logged in,
   For example you can use:
   Context.User.Identity.IsAuthenticated
   or Membership.GetUser()
2. Add that httpHandler to the web.config file and specify the
   
   
   

   <add verb="*" path="MyWebApp1/config.xml" type="MyNS.ConfigXmlHandler" />

   
   
   
   
3. Modify the IIS settings for your webapp (here it is MyWebApp1), usually your webapp is located in c:\inetpub\wwwroot\MyWebApp1. Using the IIS management console, find the node for MyWebApp1 and modify its properties. Add an application extension mapping for '.xml', so that the asp.net engine processes it. This way the request for xml files will be routed via the aspnet dll.
4. asdf
5. Caveat: Step 1 would be same for all IIS versions, but the other steps would be different based on which IIS you use, basically different from IIS5/6 with IIS7. Configure HttpHandlers in IIS,  Difference between IIS 7 integrated and classic mode

Resources:

• Good basic explanation of HttpHandlers and HttpModules for asp.net: Link
• How to register HttpHandler: Link
• What is the difference between IIS7 classic mode vs integrated mode. (classs and defaultAppPool) : Link
• Difference between IIS 7 integrated and classic mode