IIS File Type

[TheSeoGuy]

We are transferring a site to our server and I have a few questions.

1. The site allows for html file extensions to use include files. We were able to accommodate this set up by pointing .html files to the ssinc.dll through the Application Mappings section. (Is this a major security risk?)

2. The include files used in this site are of type .inc. Presently our IIS configuration doesn't support this file type. (How can I set this file type up as a viable type for IIS? And... Is this a major security risk?)

Any help would be greatly appreciated.

Thanks!

[mattur]

Enabling SSI's on .html just means every .html file will be parsed for includes by the server before the page is delivered.

You shouldn't need to configure an .inc file type. It should work fine for a HTML include without any further configuration.

If you were using an .inc file to include ASP code then this could be a security risk since someone directly requesting the .inc file would see a plaintext version of your ASP code. Using the .asp extension for ASP code includes avoids this.

I can't think of any security risks introduced by enabling SSI's for HTML files.

[TheSeoGuy]

Thanks for your reply mattur.

Does setting up html files to allow for includes change the behavior of html files for every site set up in IIS or just the specific site on which you changed the settings?

Thanks.

[mattur]

I don't have access to a server at the moment but I think you can enable it on a per server or per site basis, depending on whether you set it in master properties or site properties. HTH.