IIS 7 – How to Serve Unknown File Types

Mime type clearly specifies the intended use of the file. File extensions only hint at the content. Both can be wrong. DOC has been used by a number of text editors with a variety of internal file formats.

Faking extensions is used extensively to mislead people as the the file type. This can be used to malware of various kinds. It can also lead to security bugs. If myfile.txt would be validated for security as a text file, and later by content inspection is run as an executable, you may end up with an infected machine.

Unix uses an executable bit to indicate which file can be run. Scripts can start with a bang path indicating which interpreter should execute them. The file command can be used to fairly reliably determine the file type with or without an extension.

Using extensions to identify which file use can lead to ambiguity. If I have myfile.exe, myfile.com, myfile.bat, and myfile.cmd, which runs if I run the command myfile.

You need to add that to the list of mime types, its probable that the specific directory where it works it is included locally. You can add it globally using AppCmd.exe:

appcmd.exe set config  -section:system.webServer/staticContent /+"[fileExtension='.cxml',mimeType='text/xml']"

Or use Mime Types feature in IIS Manager.

For more info: http://www.iis.net/ConfigReference/system.webServer/staticContent/mimeMap