file access in web appliction

Hi,

I have a web application in ASP.NET. It has a subfolder which contains

1) HTML  files

2) XML files

We want that these files should not be accessible through URL to the users

For e.g.  when user will browse like following URL

http://mysite/files/myxml.xml then these files should not be accessible to the users.

I tested this for ASPX pages using following code it works

<authentication mode="Forms" >

<forms path="/" loginUrl="login.aspx" protection="All" timeout="30">

<credentials passwordFormat="Clear">

<user name="admin" password="admin"/>

credentials>