System.Web.HttpForbiddenHandler

Hi Folks

Little confused here, because about a month ago, this (I thought) was all running just fine (but did a boat-load of updates for both Windows 10 - Insider Preview, .Net and VS2015 over the last couple of weeks).

Now these web.config httphandler settings are getting ignored.

Details:

IIS: v10.0.14257.1000

Visual Studio Enterprise 2015, version 140.0.24720.00 Update 1

.Net Framework v4.6.01038

Web.Config fragments, relevant sections:

:

    <httpHandlers>
        <remove verb="*" path="*.ad" />
        <remove verb="*" path="*.adprototype" />
        <remove verb="*" path="*.asa" />
        <remove verb="*" path="*.asax" />
        <remove verb="*" path="*.ascx" />
        <remove verb="*" path="*.ashx" />
        <remove verb="*" path="*.asmx" />
        <remove verb="*" path="*.aspx" />
        <remove verb="*" path="*.bmp" />
        <remove verb="*" path="*.browser" />
        <remove verb="*" path="*.cache" />
        <remove verb="*" path="*.cd" />
        <remove verb="*" path="*.compiled" />
        <remove verb="*" path="*.config" />
        <remove verb="*" path="*.cs" />
        <remove verb="*" path="*.csproj" />
        <remove verb="*" path="*.css" />
        <remove verb="*" path="*.dat" />
        <remove verb="*" path="*.dd" />
        <remove verb="*" path="*.disco" />
        <remove verb="*" path="*.dll" />
        <remove verb="*" path="*.dsdgm" />
        <remove verb="*" path="*.dsprototype" />
        <remove verb="*" path="*.exclude" />
        <remove verb="*" path="*.gif" />
        <remove verb="*" path="*.htm" />
        <remove verb="*" path="*.java" />
        <remove verb="*" path="*.jsl" />
        <remove verb="*" path="*.jpg" />
        <remove verb="*" path="*.js" />
        <remove verb="*" path="*.jsl" />
        <remove verb="*" path="*.ldb" />
        <remove verb="*" path="*.ldd" />
        <remove verb="*" path="*.lddprototype" />
        <remove verb="*" path="*.ldf" />
        <remove verb="*" path="*.lic" />
        <remove verb="*" path="*.licx" />
        <remove verb="*" path="*.licenses" />
        <remove verb="*" path="*.lsad" />
        <remove verb="*" path="*.lsadprototype" />
        <remove verb="*" path="*.map" />
        <remove verb="*" path="*.master" />
        <remove verb="*" path="*.mcwebhelp" />
        <remove verb="*" path="*.mdb" />
        <remove verb="*" path="*.mdf" />
        <remove verb="*" path="*.msgx" />
        <remove verb="*" path="*.myapp" />
        <remove verb="*" path="*.pdb" />
        <remove verb="*" path="*.pdf" />
        <remove verb="*" path="*.png" />
        <remove verb="*" path="*.ps1" />
        <remove verb="*" path="*.psm1" />
        <remove verb="*" path="*.psd1" />              
        <remove verb="*" path="*.pubxml" />
        <remove verb="*" path="*.refresh" />
        <remove verb="*" path="*.resources" />
        <remove verb="*" path="*.resx" />
        <remove verb="*" path="*.rules" />
        <remove verb="*" path="*.sd" />
        <remove verb="*" path="*.sdmDocument" />
        <remove verb="*" path="*.settings" />
        <remove verb="*" path="*.sitemap" />
        <remove verb="*" path="*.skin" />
        <remove verb="*" path="*.ssdgm" />
        <remove verb="*" path="*.ssmap" />
        <remove verb="*" path="*.svc" />
        <remove verb="*" path="*.txt" />
        <remove verb="*" path="*.user" />
        <remove verb="*" path="*.vb" />
        <remove verb="*" path="*.vbproj" />
        <remove verb="*" path="*.vspscc" />
        <remove verb="*" path="*.vjsproj" />
        <remove verb="*" path="*.vsdisco" />
        <remove verb="*" path="*.webinfo" />
        <remove verb="*" path="*.wsdl" />
        <remove verb="*" path="*.xml" />        
        <add verb="*" path="*.ad" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.adprototype" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.asa" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.asax" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ascx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ashx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.asmx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.aspx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.bmp" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.browser" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.cache" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.cd" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.compiled" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.config" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.cs" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.csproj" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.css" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.dat" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.dd" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.disco" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.dll" type="System.Web.HttpForbiddenHandler" validate="true" />
        <add verb="*" path="*.dsdgm" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.dsprototype" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.exclude" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.gif" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.htm" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.java" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.jsl" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.jpg" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.js" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.jsl" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ldb" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ldd" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.lddprototype" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ldf" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.lic" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.licx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.licenses" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.lsad" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.lsadprototype" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.map" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.master" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.mcwebhelp" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.mdb" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.mdf" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.msgx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.myapp" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.pdb" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.pdf" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.png" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ps1" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.psm1" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.psd1" type="System.Web.HttpForbiddenHandler" />              
        <add verb="*" path="*.pubxml" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.refresh" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.resources" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.resx" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.rules" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.sd" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.sdmDocument" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.settings" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.sitemap" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.skin" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ssdgm" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.ssmap" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.svc" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.txt" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.user" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.vb" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.vbproj" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.vspscc" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.vjsproj" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.vsdisco" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.webinfo" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.wsdl" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.xml" type="System.Web.HttpForbiddenHandler"  validate="true" />
      </httpHandlers>   
  </system.web>

:

  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />

:

Before, .XML and .DLLs were NOT allowed to be directly downloaded, now this is ignored?

Finally, I want everything to be explicitly declared at the source code level (web.config) v.s. anything DevOps might be asked to do.