Ok, thanks Rick. We are looking at everyone's feedback to determine the things we will do to set up the folder and associated permissions. This has been a good experience with reading the feedback from various points of view.

My main purpose was to gain an understanding of the security issues and methodologies to safely implement the folder(s) under the current incranation of IIS and the MS' security model. Still got lots to learn and this stuff seems to change all the time.

Bill

>Do whatever makes sense. I tend to put uploaded files into the virtual folder structure, then protect the folder with a location tag that disallows all users. There's no risk there as long as you set the access appropriately.
>
>One reason this is often desirable is that the Web application often doesn't have rights to write outside of the virtual folder structure. You also can't easily map paths with Server.MapPath(), which means you have to track the upload folder using config settings.
>
>And if you do allow uploading to a separate non-Web folder, realize that that has security potential issues as well. You're potentially opening yourself to other security issues as you now have a path that the Web server account has to have access to.
>
>Either way there are potential security issues with either of these approaches that require locking down security settings.
>
>+++ Rick ---
>
>>We have an ASP.NET application that requires uploading and storing of files. A developer here wants to place the upload attachment folder within the application physical folder structure associated with the virtual directories.
>>
>>I do not want to place it there due to the possibility of security issues. Are there accepted practices for the placement of application file upload folders? Is this documented anywhere?
>>
>>Thanks,
>>Bill