asp.netwindowsiishttp-status-code-404bin-folder

Error 404 on /bin browsing

I run IIS 7.5 on Windows Server 2008 R2.
I'm getting a 404: file not found error when I browse the "/bin" folder. I understand that this is a security policy by Microsoft.

I tried doing what is written in here but it didn't solve the issue. Any ideas?

EDIT:
Should be noted that I have no security issues. I run the IIS for direcotry browsing in a private network. Eventually I need to perform crawling and indexing on it. The problem is that pages under "/bin" and '/AppConfig" are not being crawled because of the 404 error.

I just need a solution for this issue. Again, no security issues are relevant here.

Solution

  • Bin folder is not intended as a place where a developer should put web pages.

    In IIS 7.5 you can configure

    1. Open Internet Information Services (IIS) Manager
    2. In the Connections pane, go to the connection, site, application, or directory for which you want to modify your request filtering settings.
    3. In the Home pane, double-click Request Filtering.
    4. In the Request Filtering pane, click the Hidden Segments tab
    5. Select the relative path that you want to show (BIN folder), and then click Remove in the Actions pane.

    The same can be done via web.config

    <configuration>
  <system.webServer>
   <security>
     <requestFiltering>
        <hiddenSegments applyToWebDAV="false">
           <remove segment="Bin" />
        </hiddenSegments>
     </requestFiltering>
   </security>
  </system.webServer>
</configuration>

    Anyway, in orded to avoid problems on development server and on any deploy server, i think that the easiest solution is to move that pages to another folder.

    Read here:

    ASP.NET recognizes certain folder names that you can use   
for specific types of content.  
The following table lists the reserved folder names and the type   
of files that the folders typically contain.

Note
The content of application folders, except for the App_Themes folder,
is not served in response to Web requests,
but it can be accessed from application code.