Serve .well-known Verification Files from nopCommerce
This plugin registers a route and controller that serve files placed in a nopCommerce site's .well-known folder over HTTP, so domain-verification and challenge files are reachable at /.well-known/... It supports Apple Pay domain verification, Let's Encrypt ACME HTTP-01 challenges, and Apple universal links (apple-app-site-association) out of the box.
What It Does
- File serving route — Public route /.well-known/{path} returns the matching physical file from disk.
- Nested and flat paths — Supports /.well-known/{file}, /.well-known/{folder}/{file} and deeper paths.
- JSON content type — Serves apple-app-site-association and .json files with the application/json content type.
- Plain text content type — Serves all other .well-known files with the text/plain content type.
- 404 handling — Returns a real HTTP 404 when no matching file exists, instead of the store's page-not-found page.
- Closed and private stores — Files stay reachable while the store is closed or requires login, so verification and certificate renewal keep working.
- Apple Pay domain verification — Makes the apple-developer-merchantid-domain-association file reachable for Apple Pay setup.
- Let's Encrypt ACME challenges — Serves files under /.well-known/acme-challenge/ for the HTTP-01 challenge.
- Apple universal links — Serves apple-app-site-association with the correct content type for universal link verification.
- Path-traversal protection — Resolved file paths must stay under the resolved .well-known root before being served.
How It Works
- Install the plugin, which adds the .well-known route. There is nothing to configure.
- Place verification or challenge files in the site's .well-known or well-known folder under the web root or content root.
- A request to /.well-known/{path} is matched against four candidate root folders in order.
- The matching file streams back with a JSON or plain text content type, or a 404 if none is found.
Specs & Requirements
- nopCommerce — 5.00, 4.90, 4.80, 4.70, 4.60, 4.50, 4.40, 4.30, 4.20
- Plugin type — Misc plugin with no admin configuration page
- Store setup — Place the verification or challenge files directly in the site's .well-known or well-known folder
