Today at an MSDN event I ended up talking with a number of people about an issue relating to security in ASP.NET. The problem was presented where the authentication would only restrict access top .aspx files and not other files such as Word (.doc) or Excel (.xls) files that might also need to be secured. I recently had a similar problem which I was able to resolve by registering the appropriate extensions in the Application Mappings within the Application Configuration within Internet Services manager. By mapping the .doc and .xls file extensions to the same executable as the .aspx pages (aspnet_isapi.dll) they will have their access restricted as well by the application security.
