The image resizer integrates with ASP.NET's URL authorization system quite well. It can't be exploited to access protected files, because it is simply a normal Jpeg/Png/Gif handler. However, we only want the handler to execute for files that actually need resizing - if possible we want control to pass back to IIS6 for performance gains.
Since we only want some .jpg requests to go to the handler, we need to do some logic before we assign a handler. In IIS 6 and IIS7 Classic Pipeline mode, we need to drop in a CustomDefaultHandler at the bottom of the httpHandlers list.
<httpHandlers>
<clear/>
<add path="trace.axd" verb="*" type="System.Web.Handlers.TraceHandler" validate="true"/>
<add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="true"/>
<add path="*.axd" verb="*" type="System.Web.HttpNotFoundHandler" validate="true"/>
<add path="*.aspx" verb="*" type="System.Web.UI.PageHandlerFactory" validate="true"/>
<add path="*.ashx" verb="*" type="System.Web.UI.SimpleHandlerFactory" validate="true"/>
<add path="*.asmx" verb="*" type="System.Web.Services.Protocols.WebServiceHandlerFactory, System.Web.Services, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" validate="false"/>
<add path="*.rem" verb="*" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" validate="false"/>
<add path="*.soap" verb="*" type="System.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory, System.Runtime.Remoting, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" validate="false"/>
<add path="*.svc" verb="*" type="System.ServiceModel.Activation.HttpHandler, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" validate="false"/>
<!-- These are forbidden extensions. I've added a lot here, such as .swp, .sln, .suo, .bak, and .db -->
<add path="*.asax" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.ascx" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.master" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.skin" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.browser" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.sitemap" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.dll.config" verb="GET,HEAD" type="System.Web.StaticFileHandler" validate="true"/>
<add path="*.exe.config" verb="GET,HEAD" type="System.Web.StaticFileHandler" validate="true"/>
<add path="*.config" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.cs" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.csproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.vb" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.vbproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.webinfo" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.licx" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.resx" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.resources" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.mdb" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.vjsproj" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.java" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.jsl" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.ldb" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.ad" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.dd" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.ldd" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.sd" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.cd" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.adprototype" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.lddprototype" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.sdm" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.sdmDocument" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.mdf" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.ldf" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.exclude" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.refresh" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.db" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.bak" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.swp" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.sln" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*.suo" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="robots.txt" verb="*" type="System.Web.StaticFileHandler" validate="true"/>
<!-- I've also added .txt to prevent my todo files and readme files from being accessible. If you want to serve .txt files, remove this line -->
<add path="*.txt" verb="*" type="System.Web.HttpForbiddenHandler" validate="true"/>
<add path="*" verb="GET,HEAD,POST" type="fbs.Handlers.CustomDefaultHandler" validate="true"/>
<add path="*" verb="*" type="System.Web.HttpMethodNotAllowedHandler" validate="true"/>
</httpHandlers>