How to arrest '.axd' files from script level/Web.config/IIS & how to set Referrer Http header in Sever Side/Web.config

Hi @Sriram K ,

How to arrest '.axd' files

You can remove these files by adding the following to all my web.config files:

<httpHandlers>  
        <remove path="WebResource.axd" verb="GET"/>  
        <remove path="WebResource.axd" verb="POST"/>  
        <remove path="ScriptResource.axd" verb="GET"/>  
        <remove path="ScriptResource.axd" verb="POST"/>  
 </httpHandlers>  

Now when you try to get these pages you might be prompted to login or given 404 error.
Also remove them from in

<system.webServer>   
     <handlers>  
         <remove name="ScriptResourceIntegrated-4.0"/>  
     </handlers>  
</system.webServer>   
  
<location path="WebResource.axd">  
 <system.web>   
<authorization>  
 <deny users="*"/>  
 </authorization>   
</system.web>   
</location>  

Or you can use *.axd as a disallowed extension in request filtering
The same effect can be achieved using the following web.config section:

<system.webServer>  
    <security>  
        <requestFiltering>  
            <fileExtensions>  
                <add fileExtension=".axd" allowed="False" />  
            </fileExtensions>  
        </requestFiltering>  
    </security>  
</system.webServer>  

how to set Referrer Http header in Sever Side

Referer is controlled (and sent) by the client. You can't affect it server-side. There may be some JavaScript that you could emit that'd get the client to do it - but it's probably considered a security flaw.

Best regards,
Lan Huang

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.