forms-based authentication

[Vic]

I am trying to implement a forms-based authentication on my website, so some
directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or
the files with the extension mapped to aspnet_isapi.dll) are the ones being
secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by .NET.
How is it going to affect the performance of the site? Is there another way
of achieving the same thing?

Thanks,
Vic

[Steve C. Orr [MVP, MCSD]]

I accomplished this in a recent project by putting other files in a private
directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteFile to grab the file from the private directory and output it
to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear();
Response.AddHeader("Content-Disposition","inline;filename=myfile.doc");
Response.WriteFile("c:\privatedir\myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or the files with the extension mapped to aspnet_isapi.dll) are the ones being secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by ..NET. How is it going to affect the performance of the site? Is there another way of achieving the same thing?

Thanks,
Vic

[John Saunders]

"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some directories will have web.config file which will deny certain users, based
on role, etc. The problem I encountered is that it's only asp.net files (or the files with the extension mapped to aspnet_isapi.dll) are the ones being secured.

The solution I found is to map all of the extension I'd keep in my secured
directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by ..NET. How is it going to affect the performance of the site? Is there another way of achieving the same thing?

The only way to find out how it performs is to try it.

As a general statement, consider that it shouldn't be any worse than the
performance of processing ASP.NET files, which have to deal with executing
code and possibly even compiling it.

One thing to be aware of: the StaticFileHandler which ASP.NET uses for these
file types seems to read the entire file into memory before sending it out.
This can be an issue for huge files...
--
John

[Vic]

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteFile("c:\privatedir\myfile.doc");

Of course, this could also load the file in the memory first...

Thanks,
Vic

"John Saunders" <john.saunders at surfcontrol.com> wrote in message
news:%2****************@TK2MSFTNGP12.phx.gbl...

"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dll) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

The only way to find out how it performs is to try it.

As a general statement, consider that it shouldn't be any worse than the
performance of processing ASP.NET files, which have to deal with executing
code and possibly even compiling it.

One thing to be aware of: the StaticFileHandler which ASP.NET uses for

these file types seems to read the entire file into memory before sending it out. This can be an issue for huge files...
--
John

[Vic]

Thanks, Steve.

It sure does help...

Vic

"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

I accomplished this in a recent project by putting other files in a private directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteFile to grab the file from the private directory and output it to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear();
Response.AddHeader("Content-Disposition","inline;filename=myfile.doc");
Response.WriteFile("c:\privatedir\myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so

some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dll) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

Thanks,
Vic

[Vic]

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteFile() ? I want user to prompted with the Save As dialog and
the file to be downloaded to the specified location on user's PC, instead of
dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

I accomplished this in a recent project by putting other files in a private directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteFile to grab the file from the private directory and output it to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear();
Response.AddHeader("Content-Disposition","inline;filename=myfile.doc");
Response.WriteFile("c:\privatedir\myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website, so

some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net files

(or

the files with the extension mapped to aspnet_isapi.dll) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there another

way

of achieving the same thing?

Thanks,
Vic

[John Saunders]

"Vic" <ro****@gat.com> wrote in message
news:O9*************@TK2MSFTNGP11.phx.gbl...

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteFile("c:\privatedir\myfile.doc");

Of course, this could also load the file in the memory first...

Victor,

In a similar case, I wrote a asynchronous HttpHandler (implementing
IHttpAsyncHandler) to handle product downloads from our site. I found the
following article very helpful in that:

Use Threads and Build Asynchronous Handlers in Your Server-Side Web Code
(http://msdn.microsoft.com/msdnmag/is.../default.aspx).

I hope that helps,
John

[Steve C. Orr [MVP, MCSD]]

change inline to attachment on the Response.Addheader line.
Like this:
Response.AddHeader("Content-Disposition","attachment;filename=myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com

"Vic" <ro****@gat.com> wrote in message
news:ul*************@TK2MSFTNGP10.phx.gbl...

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteFile() ? I want user to prompted with the Save As dialog and
the file to be downloaded to the specified location on user's PC, instead of dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

I accomplished this in a recent project by putting other files in a private

directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteFile to grab the file from the private directory and output it

to the user. Of couse the ASPNET user account needs read access to the
private directory.
I used code similar to this:
Response.Clear();
Response.AddHeader("Content-Disposition","inline;filename=myfile.doc");
Response.WriteFile("c:\privatedir\myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...

I am trying to implement a forms-based authentication on my website,

so some

directories will have web.config file which will deny certain users, based on role, etc. The problem I encountered is that it's only asp.net

files (or

the files with the extension mapped to aspnet_isapi.dll) are the ones

being

secured.

The solution I found is to map all of the extension I'd keep in my secured directory to aspnet_isapi.dll.

I am planning to map .htm, *.exe, and *.shtm files to be processed by

.NET.

How is it going to affect the performance of the site? Is there

another way

of achieving the same thing?

Thanks,
Vic

[Vic]

Thanks Steve. It works perfectly.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:Ol**************@TK2MSFTNGP12.phx.gbl...

change inline to attachment on the Response.Addheader line.
Like this:
Response.AddHeader("Content-Disposition","attachment;filename=myfile.doc");
--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com

"Vic" <ro****@gat.com> wrote in message
news:ul*************@TK2MSFTNGP10.phx.gbl...

Steve.

Is there an easy way to simulate the Save As behavior with
Response.WriteFile() ? I want user to prompted with the Save As dialog and

the file to be downloaded to the specified location on user's PC,

instead of

dumping it into the page.

Thanks in advance.

Vic
"Steve C. Orr [MVP, MCSD]" <St***@Orr.net> wrote in message
news:%2****************@TK2MSFTNGP11.phx.gbl...

I accomplished this in a recent project by putting other files in a

private

directory.
Then when I needed to send one of the files to the user, I'd use
Response.WriteFile to grab the file from the private directory and

output

it

to the user. Of couse the ASPNET user account needs read access to the private directory.
I used code similar to this:
Response.Clear();
Response.AddHeader("Content-Disposition","inline;filename=myfile.doc"); Response.WriteFile("c:\privatedir\myfile.doc");

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
Hire top-notch developers at http://www.able-consulting.com


"Vic" <ro****@gat.com> wrote in message
news:uB**************@TK2MSFTNGP12.phx.gbl...
> I am trying to implement a forms-based authentication on my website,

so some
> directories will have web.config file which will deny certain users,

based

> on role, etc. The problem I encountered is that it's only asp.net files (or
> the files with the extension mapped to aspnet_isapi.dll) are the ones being
> secured.
>
> The solution I found is to map all of the extension I'd keep in my

secured

> directory to aspnet_isapi.dll.
>
> I am planning to map .htm, *.exe, and *.shtm files to be processed by .NET.
> How is it going to affect the performance of the site? Is there another way
> of achieving the same thing?
>
> Thanks,
> Vic
>
>

[Vic]

Thanks John.

I read article -- it sure does make sense making those downloads a separate
thread.

Vic
"John Saunders" <john.saunders at surfcontrol.com> wrote in message
news:ef**************@TK2MSFTNGP11.phx.gbl...

"Vic" <ro****@gat.com> wrote in message
news:O9*************@TK2MSFTNGP11.phx.gbl...

Thanks, John.

I think it's not such a hot idea, since some of the files are more than
20MB...

I'll probably use Steve's approach:
Response.WriteFile("c:\privatedir\myfile.doc");

Of course, this could also load the file in the memory first...

Victor,

In a similar case, I wrote a asynchronous HttpHandler (implementing
IHttpAsyncHandler) to handle product downloads from our site. I found the
following article very helpful in that:

Use Threads and Build Asynchronous Handlers in Your Server-Side Web Code
(http://msdn.microsoft.com/msdnmag/is.../default.aspx).

I hope that helps,
John