IIS: Hidden segments and custom errors clash
<p>I need to secure the <code>/app</code> directory and its files from probing. I tried using <code>&lt;hiddenSegment&gt;</code> in a <code>web.config</code> file and it works nicely… except that when I add an IIS custom error page, it does not work.</p>

<h2>Application structure</h2>

<pre class="lang-none prettyprint-override"><code>.
├── app
│   ├── template
│   │   ├── footer.php
│   │   ├── header.php
│   │   └── index.php
│   ├── error-handler.php
│   ├── footer.php
│   └── header.php
├── template
│   ├── css
│   └── js
└── web.config
</code></pre>

<p><em>The entire <code>/app</code> directory needs to be hidden; its contents must be safe from probing.</em></p>

<h2><code>web.config</code></h2>

<pre class="lang-xml prettyprint-override"><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
&lt;configuration&gt;
    &lt;system.webServer&gt;
        &lt;httpErrors errorMode="Custom"&gt;
            &lt;remove statusCode="404" /&gt;
            &lt;error statusCode="404" prefixLanguageFilePath="" path="/app/error-handler.php" responseMode="ExecuteURL" /&gt;
            &lt;remove statusCode="403" /&gt;
            &lt;error statusCode="403" prefixLanguageFilePath="" path="/app/error-handler.php" responseMode="ExecuteURL" /&gt;
        &lt;/httpErrors&gt;
        &lt;security&gt;
            &lt;requestFiltering&gt;
                &lt;hiddenSegments&gt;
                    &lt;add segment="app" /&gt;
                &lt;/hiddenSegments&gt;
            &lt;/requestFiltering&gt;
        &lt;/security&gt;
    &lt;/system.webServer&gt;
&lt;/configuration&gt;
</code></pre>

<p>I've been really struggling to try to both hide the <code>/app</code> directory and make IIS serve the error handler in <code>/app/error-handler.php</code>. Any help is much appreciated.</p>