Do not serve specific files in /wwwroot with ASP.NET Core

Sometimes I have non-image/js/css files in /wwwroot, for internal purposes. For example, maybe I have a README.md in some subdirectory, documenting something about that location; that would be the natural place for it.

But in an ASP.NET Core app, everything in /wwwroot is served to the client, including those private files.

Can I prevent them being served?

One option is to configure your csproj file to avoid copying them on publish.

For example:

<ItemGroup>
	<Content Update="wwwroot/**/*.md">
		<CopyToPublishDirectory>Never</CopyToPublishDirectory>
	</Content>
</ItemGroup>

Another option would be to use post-build events to delete the files

Kind of a hack, but if you're serving the files with UseStaticFiles, you could use the OnPrepareResponse callback to do something like this:

var builder = WebApplication.CreateBuilder(args);
var app = builder.Build();
app.MapGet("/", () => "Hello World!");
app.UseStaticFiles(new StaticFileOptions
{
    OnPrepareResponse = r =>
    {
        // criteria for whatever files you want to be private
        if (r.File.Name.EndsWith("md"))
        {
            r.Context.Response.StatusCode = 404;
            r.Context.Response.ContentLength = 0;
            r.Context.Response.Body = Stream.Null;
        }
    }
});
app.Run();

Credit: I referred to this post for some details, such as resetting ContentLength and the Body stream.