How to allow `.config` file download?

[ahdung]

I hope all files in a specified folder can be download, so I did this:

var provider = new FileExtensionContentTypeProvider();
provider.Mappings[".config"] = "application/octet-stream";

app.UseStaticFiles(new StaticFileOptions()
{
    FileProvider          = new PhysicalFileProvider(Path.Combine(env.ContentRootPath, "xxx")),
    RequestPath           = "/xxx",
    ServeUnknownFileTypes = true,
    DefaultContentType    = "application/octet-stream",
    ContentTypeProvider   = provider,
});

it work well for .exe|.dll, except .config, got this:

Please help.

[blowdart]

IIS by default will block .config urls, which frankly is a good thing. If you must allow it, and I strongly recommend you do not allow it because for older asp.net versions config files contain secrets you can try this. However, I repeat this is a bad idea from a security perspective.

[ahdung]

@blowdart Thank you for your link, it's worked:

<system.webServer>
  <security>
    <requestFiltering>
      <fileExtensions>
        <remove fileExtension=".config" />
      </fileExtensions>
    </requestFiltering>
  </security>
</system.webServer>

Regard security, I know what I do.