<?xml version="1.0" encoding="UTF-8"?>
<configuration>

  <system.webServer>
    <security>
      <authorization>
        <!-- Deny all users access to the root of the website, since it
             contains this web.config -->
        <remove users="*" roles="" verbs="" />
        <add accessType="Deny" users="*" />
      </authorization>
      <requestFiltering allowDoubleEscaping="true" />
    </security>
    <caching enabled="false" enableKernelCache="false" />
  </system.webServer>

  <location path="vsa" allowOverride="false">
    <system.webServer>
      <directoryBrowse enabled="true" showFlags="Date, Time, Size, Extension" />
      <defaultDocument>
        <files>
          <!-- When requesting a file listing, don't serve up the default
               index.html file if it exists. -->
          <clear />
        </files>
      </defaultDocument>

      <security>
        <authorization>
          <!-- Allow all users access to the Public folder -->
          <remove users="*" roles="" verbs="" />
          <add accessType="Allow" users="*" roles="" />
        </authorization>

        <!-- Unblock all sourcecode related extensions (.cs, .aspx, .mdf)
             and files/folders (web.config, bin) -->
        <requestFiltering>
          <hiddenSegments>
            <clear />
          </hiddenSegments>
          <fileExtensions>
            <clear />
          </fileExtensions>
        </requestFiltering>
      </security>

      <!-- Map all extensions to the same MIME type, so all files can be
           downloaded. -->
      <staticContent>
        <clear />
        <mimeMap fileExtension="*" mimeType="application/octet-stream" />
      </staticContent>
    </system.webServer>
  </location>

</configuration>
