IIS is serving my web.config file

Giganews Newsgroups
Subject: IIS is serving my web.config file
Posted by:  darrel (notre…@notreal.com)
Date: Fri, 8 Aug 2008

I've been googling and asking around without much luck. I'm not really sure
if this is an IIS issue or .net issue, but I thought I'd give it a try in
here too:

I'm trying to temporarily shut down a site and redirect everyone to a page
explaining why.

To do that, I turned off the old site in IIS and turned on a different
default site, and then set a custom 404 error page.

Of course, that only redirects all requests for non-aspx files. To
accomodate the requests for aspx files, I added to the web.config file to
handle that:

<customErrors mode="RemoteOnly"
                <error statusCode="404" redirect="movingmessage.html"/>

This works on the local server, but when I try and access a page on the
'old' site from my web browser, instead of the redirect happening, IIS is
sending my actual web.config file to my web browser. IE is actually loading
the config file as an XML file (which it is, of course).

I thought from a security standpoint, IIS would never actually server a
.config file?