wsc-mvc/public/web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <!--
      No hiddenSegments needed here: Framework/, Controllers/, tests/,
      tools/, docs/, and logs/ all live as siblings OUTSIDE this "public"
      folder, which is IIS's entire site physical path. There is no code
      path by which IIS could serve them, regardless of web.config -
      physical separation, not a filtering rule, is what protects them. See
      docs/ARCHITECTURE.md / docs/DECISIONS.md. The extension denylist below
      is kept only as cheap defense-in-depth against a stray file someday
      landing directly inside public/ by mistake.
    -->
    <security>
      <requestFiltering>
        <fileExtensions>
          <add fileExtension=".wsc" allowed="false" />
          <add fileExtension=".vbs" allowed="false" />
          <add fileExtension=".ps1" allowed="false" />
          <add fileExtension=".md" allowed="false" />
        </fileExtensions>
      </requestFiltering>
    </security>
    <!--
      No /self-test rewrite rule on this production site: diagnostics are
      exposed only by the separate test app. Defense in depth lives in the
      bootstrap too: Default.asp always passes applicationName="production",
      so even a direct Default.asp?route=/self-test request is rejected by
      the shared framework route allowlist.
    -->
    <rewrite>
      <rules>
        <rule name="WscMvc-Root" stopProcessing="true">
          <match url="^$" />
          <action type="Rewrite" url="Default.asp?route=/hello" appendQueryString="false" />
        </rule>
        <rule name="WscMvc-Hello" stopProcessing="true">
          <match url="^hello/?$" />
          <action type="Rewrite" url="Default.asp?route=/hello" appendQueryString="false" />
        </rule>
      </rules>
    </rewrite>
    <defaultDocument>
      <files>
        <clear />
        <add value="Default.asp" />
      </files>
    </defaultDocument>
  </system.webServer>
</configuration>