App_Data, App_Code and other App_* folder protection magic

Today I was asked question how ASP.NET protects this folders’ content from external access. ASP.NET does a little magic there with ISAPI filter aspnet_filter.dll, which you can see on IIS Manager\{Your PC Name}\Web Sites\ISAPI Filters tab.

WebDev.WebServer check this internally in WebDev.WebHost.dll

List of protected dirs: “/bin”, “/app_browsers”, “/app_code”, “/app_data”, “/app_localresources”, “/app_globalresources”, “/app_webreferences”.