ASVS 5.0 V13.4.7: Serve Only Allowed File Extensions

ASVS 5.0 V13.4.7 is a Level 3 requirement. The web tier must be configured to serve only files with specific, approved extensions, so that configuration files, backups and source code are not delivered by accident.

Think allowlist, not blocklist. You name what may be served and refuse everything else.

Why it matters

Web roots collect clutter: config.php.bak, app.js.map, dump.sql, .env, web.config.old. A blocklist of "bad" extensions always misses one. Source maps are a good example, because they can hand over your original, unminified source.

An allowlist makes new clutter harmless by default.

How to implement it

nginx, static site:

location / {
    try_files $uri $uri/ =404;
}
# Only these file types are served from the static root
location ~* \.(?:html|css|js|png|jpg|jpeg|gif|svg|webp|woff2|ico|txt|json)$ {
    try_files $uri =404;
}
location ~ \.[^/]*$ {
    return 404;
}

The last block catches any other extension. Test the order carefully, because nginx picks regex locations in file order.

Apache:

<FilesMatch "^.*$">
    Require all denied
</FilesMatch>
<FilesMatch "\.(html|css|js|png|jpg|jpeg|gif|svg|webp|woff2|ico|txt)$">
    Require all granted
</FilesMatch>

Also keep source maps out of the deployed folder unless you intend to publish them, and fail the build if a .map, .bak, .sql or .env file is present in the output directory.

How to test it

Create harmless probe files in a staging copy of the web root, with extensions like .bak, .sql, .old and .map, then request each one. Every one must return 404 or 403. Remove the probes afterward.

Run the same check in the pipeline against the built artifact with a simple find dist -type f filtered by your allowlist.

Common mistakes

• Building the allowlist, then leaving a catch all location above it.
• Allowing .json for a single data file and exposing every JSON config in the same folder.
• Case sensitivity: .BAK or .Php slipping past a lowercase pattern.
• Trusting that a CDN will filter on its own.

Quick check

Sources

• OWASP ASVS