Control Access To File Types In asp.net

[Joey]

I have a web app that uses forms authentication. The app also has a
downloads section, and I need to be able to use <location> tags to
control access to the downloadable files there (preferably by directory
instead of individual file.)

I understand that this behavior does not occur by default because IIS
does only maps certain file types (i.e. "*.aspx") to asp.net by
default. In other words, any user can download files that are within
the application's protected <location> tags simply by typing the
filename's url directly into the browser window. The request never
makes it to asp.net application, because IIS does not have those file
types mapped to asp.net.

After reading a couple of posts about this problem, I thought I could
fix it by creating IIS mappings for asp.net for the different file
types. And so I did this...I created IIS mappings for asp.net for
"*.exe", "*.pdf", "*.zip" and a few others.

It all seemed to work well at first, but...users began having problems
when downloading certain files. For example, the Acrobat Reader plugin
for IE and Firefox went haywire and quit working...it would just open a
blank white window! Similar problems were experienced when trying to
download zip files.

And so, I finally figured out that the mappings I had entered were
causing the problems, and I removed them. After that, of course,
everything started working normally again.

Now, the question...This approach is obviously not the best way to
control access to the files. Who knows a better way to do this?

[S. Justin Gengo]

Joey,

Here are two thoughts.

1) Save the file to a SQL Database (or Access) then retrieve and deliver the
file only to authorized users:
http://aspalliance.com/articleViewer.aspx?aId=138&pId (This link shows
how to save an image to SQL. Saving a file would be similar.)

http://aspalliance.com/articleViewer.aspx?aId=140 (This link shows how
to retrieve an image from SQL. Again a file would be similar.)

2) Another option would be to change the file extensions on each file to
..aspx extensions that would map to IIS normally thus locking users out. Then
you could use a separate page to read the file into a stream reader and
deliver it to the user. That would be done similarly to what this article
shows and in fact, this article deals with exactly what you need so you may
just follow it's instructions...

http://www.codeproject.com/aspnet/Se...leDownload.asp

--
Sincerely,

S. Justin Gengo, MCP
Web Developer / Programmer

www.aboutfortunate.com

"Out of chaos comes order."
Nietzsche
"Joey" <jo*********@to pscene.com> wrote in message
news:11******** *************@g 43g2000cwa.goog legroups.com...

I have a web app that uses forms authentication. The app also has a
downloads section, and I need to be able to use <location> tags to
control access to the downloadable files there (preferably by directory
instead of individual file.)

I understand that this behavior does not occur by default because IIS
does only maps certain file types (i.e. "*.aspx") to asp.net by
default. In other words, any user can download files that are within
the application's protected <location> tags simply by typing the
filename's url directly into the browser window. The request never
makes it to asp.net application, because IIS does not have those file
types mapped to asp.net.

After reading a couple of posts about this problem, I thought I could
fix it by creating IIS mappings for asp.net for the different file
types. And so I did this...I created IIS mappings for asp.net for
"*.exe", "*.pdf", "*.zip" and a few others.

It all seemed to work well at first, but...users began having problems
when downloading certain files. For example, the Acrobat Reader plugin
for IE and Firefox went haywire and quit working...it would just open a
blank white window! Similar problems were experienced when trying to
download zip files.

And so, I finally figured out that the mappings I had entered were
causing the problems, and I removed them. After that, of course,
everything started working normally again.

Now, the question...This approach is obviously not the best way to
control access to the files. Who knows a better way to do this?

[Curt_C [MVP]]

store the files outside the WWW path. Then use a GetFile.aspx page to check
their credentials and retrieve the file and stream it to them.
This allows you the ultimate in file access control without instituting
Windows security.

--
Curt Christianson
site: http://www.darkfalz.com
blog: http://blog.darkfalz.com

"Joey" wrote:

I have a web app that uses forms authentication. The app also has a
downloads section, and I need to be able to use <location> tags to
control access to the downloadable files there (preferably by directory
instead of individual file.)

I understand that this behavior does not occur by default because IIS
does only maps certain file types (i.e. "*.aspx") to asp.net by
default. In other words, any user can download files that are within
the application's protected <location> tags simply by typing the
filename's url directly into the browser window. The request never
makes it to asp.net application, because IIS does not have those file
types mapped to asp.net.

After reading a couple of posts about this problem, I thought I could
fix it by creating IIS mappings for asp.net for the different file
types. And so I did this...I created IIS mappings for asp.net for
"*.exe", "*.pdf", "*.zip" and a few others.

It all seemed to work well at first, but...users began having problems
when downloading certain files. For example, the Acrobat Reader plugin
for IE and Firefox went haywire and quit working...it would just open a
blank white window! Similar problems were experienced when trying to
download zip files.

And so, I finally figured out that the mappings I had entered were
causing the problems, and I removed them. After that, of course,
everything started working normally again.

Now, the question...This approach is obviously not the best way to
control access to the files. Who knows a better way to do this?