The ASP.NET configuration system features an extensible infrastructure that enables you to define configuration settings at the time your ASP.NET applications are first deployed so that you can add or revise configuration settings at any time with minimal impact on operational Web applications and servers.
Configuration information is stored in XML-based text files. Any standard text editor or XML parser can be used to create and edit ASP.NET configuration files.
ASP.NET configuration settings for the entire Web server is defined in the root configuration file named C:\WINNT\Microsoft.NET\Framework\version\CONFIG\Machine.config.
Multiple configuration files, all named Web.config, can appear in multiple directories on an ASP.NET Web application server.
Each Web.config file applies configuration settings to its own directory and all child directories below it.
Configuration files in child directories can supply configuration information in addition to that inherited from parent directories, and the child directory configuration settings can override or modify settings defined in parent directories.
At run time, ASP.NET uses the configuration information provided by the Machine.config and all the Web.config files in a hierarchical directory structure to compute a collection of configuration settings for each unique URL resource. The resulting configuration settings are then cached for all subsequent requests to a resource.
ASP.NET detects changes to configuration files and automatically applies new configuration settings to Web resources affected by the changes. The server does not have to be rebooted for the changes to take effect. Hierarchical configuration settings are automatically recalculated and recached whenever a configuration file in the hierarchy is changed.
The ASP.NET configuration system is extensible. You can define new configuration parameters and write configuration section handlers to process them.
ASP.NET protects configuration files from outside access by configuring Internet Information Services ( IIS ) to prevent direct browser access to configuration files. HTTP access error 403 ( forbidden ) is returned to any browser attempting to directly request a configuration file.