How to prevent web.config files to be overwritten by config files in application subfolders

[Nedim]

The web.config files in application subfolders can override the settings of the web.config files in parent folders. In order to prevent parent config files to be overwritten, you need to configure IIS to ignore web.config files in application subfolders. 

An example for configuration hierarchy in IIS is below. In this example, there is a website called Site1. This website has two subfolders: SubDir1 and SubDir2.

Diagram: A sample IIS configuration hierarchy

Example

In this example, If you don’t want the web.config files in SubDir1 and SubDir2 folders to override settings in the web.config file of Site1 folder, use allowSubDirConfig attribute in your applicationHost.config file. For instance:

<sites>
   <site name="Site1" id="1">
      <application path="/">
         <virtualDirectory path="/" physicalPath="D:\WebApps\Site1" allowSubDirConfig="false" />
      </application>
   </site>
</sites> 

For enabling this setting in all websites hosted by IIS, use virtualDirectoryDefaults tag: 

<sites>
   …
   <virtualDirectoryDefaults allowSubDirConfig="false" />
</sites>

Note: allowSubDirConfig attribute can be used only in applicationHost.config. It is not available for web.config files. 

Ignore config files for certain subfolders only

You can also configure IIS to ignore web.config files in certain subfolders only. However, these folders has to be virtual folders. In the example below, web.config files are ignored in all subfolders except the one in subDir2.

<sites>
   <site name="Site1" id="1">
      <application path="/">
      <virtualDirectory path="/" physicalPath="D:\WebApps\Site1" allowSubDirConfig="false" />
      <virtualDirectory path="/SubDir2" physicalPath="D:\WebApps\Site1\SubDir2" allowSubDirConfig="true" />
      </application>
   </site>
</sites>

Please note that the examples above use <application path="/">. This is the root application which is created when you add a new website. If you have a specific application, make sure to use it in your config files.

 

Prevent inheritance

You may want to allow web.config files to be used in subfolders but you don’t want certain settings to be inherited by subfolders.

For example, your root web.config states that the only default document is index.htm. However, your subfolder web.config states that the only default document is iisstart.htm. If there is no such file iisstart.htm in the subfolder, root setting which is index.htm will be inherited and used. In order to prevent root settings to be inherited, use inheritInChildApplications attribute in location tag.

<location path="" inheritInChildApplications="false">
   <system.webServer>
      <defaultDocument enabled="true">
         <files>
            <add value="index.htm" />
         </files>
      </defaultDocument>
   </system.webServer>
</location> 

The location path in the example above is empty. It means that this setting will be applied to the level of the config file and below it.

More information about inheritInChildApplications: Link