forms-based authentication

[Vic]

I am trying to implement a forms-based authentication on my website, so some
directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or
the files with the extension mapped to aspnet_isapi.dl l) are the ones being
secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by .NET.
How is it going to affect the performance of the site? Is there another way
of achieving the same thing?

Thanks,
Vic

[Steve C. Orr [MVP, MCSD]]

I accomplished this in a recent project by putting other files in a private
directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteF ile to grab the file from the private directory and output it
to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear( );
Response.AddHea der("Content-Disposition","i nline;filename= myfile.doc");
Response.WriteF ile("c:\private dir\myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or the files with the extension mapped to aspnet_isapi.dl l) are the ones being secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by ..NET. How is it going to affect the performance of the site? Is there another way of achieving the same thing?

Thanks,
Vic

[John Saunders]

"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or the files with the extension mapped to aspnet_isapi.dl l) are the ones being secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by ..NET. How is it going to affect the performance of the site? Is there another way of achieving the same thing?

The only way to find out how it performs is to try it.

As a general statement, consider that it shouldn't be any worse than the
performance of processing ASP.NET files, which have to deal with executing
code and possibly even compiling it.

One thing to be aware of: the StaticFileHandl er which ASP.NET uses for these
file types seems to read the entire file into memory before sending it out.
This can be an issue for huge files...
--
John

[Vic]

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteF ile("c:\private dir\myfile.doc" );

Of course, this could also load the file in the memory first...

Thanks,
Vic

"John Saunders" <john.saunder s at surfcontrol.com > wrote in message
news:%2******** ********@TK2MSF TNGP12.phx.gbl. ..

"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dl l) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

The only way to find out how it performs is to try it.

As a general statement, consider that it shouldn't be any worse than the
performance of processing ASP.NET files, which have to deal with executing
code and possibly even compiling it.

One thing to be aware of: the StaticFileHandl er which ASP.NET uses for

these file types seems to read the entire file into memory before sending it out. This can be an issue for huge files...
--
John

[Vic]

Thanks, Steve.

It sure does help...

Vic

"Steve C. Orr [MVP, MCSD]" <St***@Orr.ne t> wrote in message
news:%2******** ********@TK2MSF TNGP11.phx.gbl. ..

I accomplished this in a recent project by putting other files in a private directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteF ile to grab the file from the private directory and output it to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear( );
Response.AddHea der("Content-Disposition","i nline;filename= myfile.doc");
Response.WriteF ile("c:\private dir\myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so

some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dl l) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

Thanks,
Vic

[Vic]

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteF ile() ? I want user to prompted with the Save As dialog and
the file to be downloaded to the specified location on user's PC, instead of
dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.ne t> wrote in message
news:%2******** ********@TK2MSF TNGP11.phx.gbl. ..

I accomplished this in a recent project by putting other files in a private directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteF ile to grab the file from the private directory and output it to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear( );
Response.AddHea der("Content-Disposition","i nline;filename= myfile.doc");
Response.WriteF ile("c:\private dir\myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so

some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dl l) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

Thanks,
Vic

[John Saunders]

"Vic" <ro****@gat.com > wrote in message
news:O9******** *****@TK2MSFTNG P11.phx.gbl...

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteF ile("c:\private dir\myfile.doc" );

Of course, this could also load the file in the memory first...

Victor,

In a similar case, I wrote a asynchronous HttpHandler (implementing
IHttpAsyncHandl er) to handle product downloads from our site. I found the
following article very helpful in that:

Use Threads and Build Asynchronous Handlers in Your Server-Side Web Code
(http://msdn.microsoft.com/msdnmag/is.../default.aspx).

I hope that helps,
John

[Steve C. Orr [MVP, MCSD]]

change inline to attachment on the Response.Addhea der line.
Like this:
Response.AddHea der("Content-Disposition","a ttachment;filen ame=myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com

"Vic" <ro****@gat.com > wrote in message
news:ul******** *****@TK2MSFTNG P10.phx.gbl...

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteF ile() ? I want user to prompted with the Save As dialog and
the file to be downloaded to the specified location on user's PC, instead of dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.ne t> wrote in message
news:%2******** ********@TK2MSF TNGP11.phx.gbl. ..

I accomplished this in a recent project by putting other files in a private

directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteF ile to grab the file from the private directory and output it

to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear( );
Response.AddHea der("Content-Disposition","i nline;filename= myfile.doc");
Response.WriteF ile("c:\private dir\myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...

I am trying to implement a forms-based authentication on my website,

so some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net

files (or

the files with the extension mapped to aspnet_isapi.dl l) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dl l.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there

another way

of achieving the same thing?

Thanks,
Vic

[Vic]

Thanks Steve. It works perfectly.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.ne t> wrote in message
news:Ol******** ******@TK2MSFTN GP12.phx.gbl...

change inline to attachment on the Response.Addhea der line.
Like this:
Response.AddHea der("Content-Disposition","a ttachment;filen ame=myfile.doc" );
--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com

"Vic" <ro****@gat.com > wrote in message
news:ul******** *****@TK2MSFTNG P10.phx.gbl...

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteF ile() ? I want user to prompted with the Save As dialog and

the file to be downloaded to the specified location on user's PC,

instead of

dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.ne t> wrote in message
news:%2******** ********@TK2MSF TNGP11.phx.gbl. ..

I accomplished this in a recent project by putting other files in a

private

directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteF ile to grab the file from the private directory and

output

it

to the user. Of couse the ASPNET user account needs read access to the private directory.
I used code similar to this:
Response.Clear( );
Response.AddHea der("Content-Disposition","i nline;filename= myfile.doc"); Response.WriteF ile("c:\private dir\myfile.doc" );

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com > wrote in message
news:uB******** ******@TK2MSFTN GP12.phx.gbl...
> I am trying to implement a forms-based authentication on my website,

so some
> directories will have web.config file which will deny certain users,

based

> on role, etc. The problem I encountered is that it's only asp.net files (or
> the files with the extension mapped to aspnet_isapi.dl l) are the ones being
> secured.
>
> The solution I found is to map all of the extension I'd keep in my

secured

> directory to aspnet_isapi.dl l.
>
> I am planning to map .htm, *.exe, and *.shtm files to be processed by .NET.
> How is it going to affect the performance of the site? Is there another way
> of achieving the same thing?
>
> Thanks,
> Vic
>
>

[Vic]

Thanks John.

I read article -- it sure does make sense making those downloads a separate
thread.

Vic
"John Saunders" <john.saunder s at surfcontrol.com > wrote in message
news:ef******** ******@TK2MSFTN GP11.phx.gbl...

"Vic" <ro****@gat.com > wrote in message
news:O9******** *****@TK2MSFTNG P11.phx.gbl...

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteF ile("c:\private dir\myfile.doc" );

Of course, this could also load the file in the memory first...

Victor,

In a similar case, I wrote a asynchronous HttpHandler (implementing
IHttpAsyncHandl er) to handle product downloads from our site. I found the
following article very helpful in that:

Use Threads and Build Asynchronous Handlers in Your Server-Side Web Code
(http://msdn.microsoft.com/msdnmag/is.../default.aspx).

I hope that helps,
John