I have an MVC3 application with a couple of areas and a portable area as well (using MVCContrib)
Normally, I keep all my content files under ~/Content and my scripts und
So after some sleep and, more importantly, stepping away from the problem I remembered that MVC does in fact offer you protection from people downloading views directly, which led me to remember the Web.config file required in the Areas folder. Sure enough, there's an httphandler that basically sends all requests to the FileNotFound handler.
All I had to do was drop a web.config file in the content folder I wanted to expose with the following:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
<validation validateIntegratedModeConfiguration="false" />
<handlers>
<remove name="BlockViewHandler" />
</handlers>
</system.webServer>
</configuration>
Problem solved.