Thanks for the info but I still need clarification. I don't completely
understand how to secure my site from anonymous users if read-only means
that not only can my app read the data (while running under IUSR), but so
can anonymous users on the Internet. The "App_Data" folder is a good
example. Can someone simply read this from their browser for instance (just
by guessing a file's name) or even write to it somehow. If so then to
protect against it, my first instinct would be to deny access to IUSR but
then my app would have to explicitly impersonate some other valid user in
order to access the folder. On a 3rd-party web-hosting site you would likely
have to use your personal account for that which means securing my password
on the server and then going through the trouble of impersonating. Moreover,
if I understand things correctly, the ASPNET account itself ("Network
Service" on Win2003 Server) still requires read/write to this folder (for
various housekeeping tasks) regardless of who my app is impersontating (IUSR
or otherwise). This all seems very complicated and therefore unlikely, i.e.,
I assume most web sites don't lock down "App_Data" this way meaning that
anonymous users can read its contents, is this not correct? If so then it's
a security problem so can you elaborate on this situation? Thanks.