CODEWITHSUNDEEP
asp.net-corerazor-pagesasp.net-core-2.1
lonix
lonix

Reputation: 20937

How do I disable ASP.NET Core's "Razor Pages"?

We use ASP.NET Core's "MVC", but not the new "Razor Pages".

I know they get served from /Pages by default, so at runtime (!!) I dropped some razor pages in there to see what would happen - and to my surprise they were served without doing anything futher!

This is a major security risk for us. On the production server, some malicious actor could drop razor pages into the correct directory, and then do considerable damage.

I assumed they could be disabled, but found nothing about this.

How can I completely disable "Razor Pages"?

Upvotes: 1

Views: 1318

Answers (1)

lonix
lonix

Reputation: 20937

Comments above by @CodeCaster say they can't be disabled, so I thought of a hacky workaround - change the directory to something random:

services
  .AddMvc();
  .WithRazorPagesRoot("/" + generateRandomString());

This isn't foolproof though - it won't stop someone who is determined enough to mess with your dlls.

(If they can be disabled, add your answer and I'll accept it.)

Upvotes: 2

Related Questions