473,671 Members | 2,480 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Secure File Delivery in Web App problem...quest ions...

Hello - I am not sure of the best way to solve this problem:

In my web app I need to delivery both static and dynamically generated files
to end-users. These files should not be accessable to users via "url
hacking". The files are of various file types (e.g. TXT; PDF; CSV; DOC;
ZIP; etc...) -

The two approaches I can conceive of offhand are both problematic--

(1) use SQL server BLOB field to store the files. Though I dont know if all
of these types are able to be stored in SQL server's BLOB, especially ZIP?
And if so, how to stream the files from the database to the client with
different formats?

(2) develp some sort of component that can retrieve the files from a secure
directory not web accessible and stream them to the client...The production
web server is clustered (not using appserver/DFS) so where does this
component reside and how to orchestrate the file delivery? How to stream
files such as PDF and ZIP?

----

I understand that these questions and all the nuances of
design/implementation cannont readily be addressed here - but I sure would
appreciate some input...I am sure that others have struggled with (ok, so
maybe I struggle with it) -- I am sure that other more experienced and gifted
folks have worked on this problem...

Any thoughts, insights, tips, tricks, or even a happy anecdote would be very
much appreciated.

Cheerio!

TIA.
Nov 19 '05 #1
2 1367
Take a look at IHttpHandler. If you develop a class that implements
this method, you can restrict downloads to specific file types and
obscure the actual URL by hard-coding path roots.

See the following MSDN article:
http://msdn.microsoft.com/msdnmag/is...s/default.aspx

"=?Utf-8?B?bnVsbHJlZg= =?=" <nu*****@discus sions.microsoft .com> wrote in message news:<28******* *************** ************@mi crosoft.com>...

In my web app I need to delivery both static and dynamically generated files
to end-users. These files should not be accessable to users via "url
hacking". The files are of various file types (e.g. TXT; PDF; CSV; DOC;
ZIP; etc...) -

Nov 19 '05 #2
Take a look at IHttpHandler. If you develop a class that implements
this method, you can restrict downloads to specific file types and
obscure the actual URL by hard-coding path roots.

See the following MSDN article:
http://msdn.microsoft.com/msdnmag/is...s/default.aspx

"=?Utf-8?B?bnVsbHJlZg= =?=" <nu*****@discus sions.microsoft .com> wrote in message news:<28******* *************** ************@mi crosoft.com>...

In my web app I need to delivery both static and dynamically generated files
to end-users. These files should not be accessable to users via "url
hacking". The files are of various file types (e.g. TXT; PDF; CSV; DOC;
ZIP; etc...) -

Nov 19 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

7
3442
by: ojorus | last post by:
Hello! I want to make a login system as secure as possible on a website I develop. * The user shall log on using a Username and a password (which is stored in a mySQL database) *The server which I use to run my application has "register_globals" activated (set to "on"), so that has to be taken into concideration *The system should be secure even if the user do not click "log out" when he is finished. (Users often just close the browser...
6
3132
by: Sarah Tanembaum | last post by:
I was wondering if it is possible to create a secure database system using RDBMS(MySQL, Oracle, SQL*Server, PostgreSQL etc) and web scripting/programming language(Perl, PHP, Ruby, Java, ASP, etc) combination? I have the following in mind: I wanted to store all my( and my brothers and sisters) important document information such as birth certificate, SSN, passport number, travel documents, insurance(car, home, etc) document, and other...
6
4819
by: Billy Jacobs | last post by:
I have a website which has both secure and non-secure pages. I want to uses forms authentication. How do I accomplish this? Originally I had my web.config file in the root with Forms Authentication set up and it worked just fine. Then I realized that I needed to have some pages unsecure. I then created 2 directories. One named Secure and the other named Public. I placed my web.config file in my
9
3076
by: Achim Kühn | last post by:
I´m planning to write a windows application using the .net framework. is there any way to secure the application so the user can´t easily disassemble and manipulate the application?
2
2207
by: lpw | last post by:
I have dilligently reviewed FAQ-lite Section 3.2, "How do I pass a pointer-to-member-function to a signal handler, X event callback, system call that starts a thread/task, etc." The only suggestion on how to deliver a signal to an object is to do it via a global variable and a wrapper function, a technique that is generally a Bad Idea (due to the usage of a global variable). I understand that this ng is dedicated to the discussion of...
3
4547
by: Matt Sollars | last post by:
I've struggled with this problem, and it's lack of examples, for a couple of months now. On several different web applications that we have written, we need to communicate with a credit card merchant servicer. On one of the projects a secure connection was made with a WebRequest object and during the reply, a trust error was received. I can't remember the full details due to the time it's been since that project. The most recent project...
0
289
by: nullref | last post by:
Hello - I am not sure of the best way to solve this problem: In my web app I need to delivery both static and dynamically generated files to end-users. These files should not be accessable to users via "url hacking". The files are of various file types (e.g. TXT; PDF; CSV; DOC; ZIP; etc...) - The two approaches I can conceive of offhand are both problematic-- (1) use SQL server BLOB field to store the files. Though I dont know if...
8
3732
by: Daniel Crespo | last post by:
Hello everybody, I'm trying to implement a secure xmlrpc server with basis on http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/496786 recipe. The thing that I'm concerned about is how can I get/create rapidly the ..pem files (the key and cert). Any help? Thanks
3
1307
by: Martin M. | last post by:
Hi everybody, Some of my colleagues want me to write a script for easy folder and subfolder creation on the Mac. The script is supposed to scan a text file containing directory trees in the following format: |-Invoices
0
8483
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8401
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
1
8603
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
8673
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
1
6236
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
5703
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4416
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2818
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
2060
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.