Q:

Secure a IIS directory while allowing angular access

I have an angular 4 app on an IIS 8 backend. The angular app gets its configuration from a JSON file stored in assets/data/config.json. The request is via httpClient.get() method. Problem is I need to have the angular app to receive the file when needed but I would like to prevent somebody to type www.mysite.com/assets/data/config.json and get the file. Also I would like to make sure nobody can post via http to this file (I think that's by default but I am not an IIS expert so I figure I ask anyhow).
Any help and/or suggestion is greatly appreciated.

A:

You can secure the file by only allowing requests from the local (or your app domain) to get it and forbid access if the request comes from a different domain. You accomplish this by using one of the modules in IIS. Still this is not entirely secure as it relies on an HTTP header that can be spoofed.
I suggest you write the config file to the browser through the page that hosts the Angular app (default.aspx or index.aspx) and then forbid the file to be accessed directly from HTTP.

