ASP 3.0 Folder/File Permissions Settings

Question

Dear Stack Over Flow Folks,

Hi, I have built a form input page in HTML that has an action to post to an ASP handler/processor .asp file. The form handler/processor .asp file contains only <% Insert VBScript Here %> and no HTML output whatsoever.

The .asp file was never intended to be a "web viewable" .asp file like an .asp home page file or html file would. It's supposed to be for my eyes only- not the public's however it does need to take info posted by the public and do something with it on it's end.

I have used VBScript/ASP3.0 to build the form handler/processor file and would like to know how to keep someone from viewing the actual VBScript in the handler/processor .asp file. I am aware of obfuscation but I would like to know how to keep prying eyes from even being able to take a look at the obfuscated code in the handler/processor file.

I realize that the server executes the .asp file first before outputting anything to the browser so I guess that my main concern is mostly that someone may could "download" the form handler/processor .asp file, then view it's contents on their machine.

Assuming the form handler .asp file is where it is, behind the root, and is on a windows server (no htaccess approach) how could one protect it so that it could never be viewed or simply pulled down via anonymous ftp or something like that?

Is there something like "script only" permissions that the system administrator could set up for a particular folder? Remember, with shared hosting I can't go above the root. If so, would the form still be able to post?

How would any of you guys go about protecting the asp file in addition to obfuscation? Any help would be greatly appreciated.

Thanks,

ASP Pee-Wee

Answer 1

Unless your code encounters an error, no one should be able to view the contents of the ASP file in the browser. (If you haven't already, add on error resume next to your code, then add some error handling to prevent leaking too much information in any error message.)

If you can (might not be available with your shared-hosting) deny FTP access to all IP addresses except those you permit.

Answer 2

In a hosted environment, no matter what you do to protect your code, bad administrative/security policy by the host provider is a critical point of failure.

While the question specifies a shared-hosted environment, the best bet is to get a dedicated server and secure it yourself. If the information is important enough, the cost should be justified.