It's a known issue that Sitecore will serve media requests regardless of the request extension. If you want to prevent media being accessed using an incorrect extension then you need to handle this yourself.
Media Request Event
One option is to add an handler for the media:request
event that will check the file extension of the request against the resolved media item, and return a 404 status code if they do not match.
using System;
using System.Linq;
using System.Net;
using Sitecore.Events;
using Sitecore.IO;
using Sitecore.Resources.Media;
namespace MySite.Custom.Media.Events
{
public class CheckMediaExtension
{
public void OnMediaRequest(object sender, EventArgs args)
{
// Safety checks
if (Sitecore.Context.Site.Name.Equals(Sitecore.Constants.ShellSiteName, StringComparison.InvariantCultureIgnoreCase))
return;
var sitecoreEventArgs = (SitecoreEventArgs) args;
if (sitecoreEventArgs == null || !sitecoreEventArgs.Parameters.Any())
return;
var request = (MediaRequest) sitecoreEventArgs.Parameters[0];
if (request == null)
return;
// Now we've established we have a valid request
var mediaItem = MediaManager.GetMedia(request.MediaUri).MediaData.MediaItem;
string requestExtension = FileUtil.GetExtension(request.InnerRequest.RequestContext.HttpContext.Request.FilePath);
if (!string.Equals(mediaItem.Extension, requestExtension, StringComparison.InvariantCultureIgnoreCase))
{
var response = request.InnerRequest.RequestContext.HttpContext.Response;
response.Clear();
response.TrySkipIisCustomErrors = true;
response.StatusCode = (int) HttpStatusCode.NotFound;
response.End();
}
}
}
}
And then patch this event handler in:
<sitecore>
<events>
<event name="media:request">
<handler type="MySite.Custom.Media.Events.MediaRequestEvent, MySite.Custom" method="OnMediaRequest"/>
</event>
</events>
</sitecore>
If you go down this route then make sure you have set the Media.RequestExtension
to empty, which will cause the media URLs to be generated with the correct file type extension.
<!--
MEDIA - REQUEST EXTENSION
The extension to use in media request URLs.
If the value is not set, the Extension field of the individual media items
will be used (ie. JPG, GIF, etc.)
Default value: "ashx"
-->
<setting name="Media.RequestExtension" set:value=""/>
/-/meida/
based URL but the sample URLs you have provided should not trigger for media and should throw 404 for items in the tree (using OOTB settings at least)