Securing Huge Downloads using IIS, aspnet_isapi.dll, HttpHandler...

[Earl Teigrob]

My company sells software and wants to provide downloadable product. Some of
these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we tested
it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and let
IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a page to
aspnet_isapi.dll to let it handle security via a authentication ticket.
I can actually get the security part working fine but when the user has
rights to download the file, then asp.net tries to process the file (using
the default HttpHandler, i imagine) and everything crawls to a stop. Ideally
I would like to send the page back to IIS for processing if asp.net security
passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I use to
bring up the download dialog to the user and then download the file? ...or
do I need to create my own, and what would it look like?

Thanks

Earl

[bruce barker]

asp.net works by iis opening a pipe to the worker process. IIS then sends
the request to the worker process which pipe the response back.

IIS has special code to speed up downloads which you will lose, (and you
will be limited to about 200 downloads at a time), but you want to replace
the PAGE module with one of your own, that just streams out the file (after
checking security). the easiest way is to to build a new vir dir for
downloads.
-- bruce (sqlwork.com)


"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:el**************@TK2MSFTNGP12.phx.gbl...

My company sells software and wants to provide downloadable product. Some of these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we tested it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and let IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a page to aspnet_isapi.dll to let it handle security via a authentication ticket.
I can actually get the security part working fine but when the user has
rights to download the file, then asp.net tries to process the file (using
the default HttpHandler, i imagine) and everything crawls to a stop. Ideally I would like to send the page back to IIS for processing if asp.net security passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I use to
bring up the download dialog to the user and then download the file? ...or
do I need to create my own, and what would it look like?

Thanks

Earl

[Ken Cox [Microsoft MVP]]

If you have a solid budget, FileUPEE is a commercial product that supports
large downloads like that over HTTP. It believe it offloads processing of
the secure files.

www.softartisans.com
"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:el**************@TK2MSFTNGP12.phx.gbl...

My company sells software and wants to provide downloadable product. Some
of
these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we
tested
it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and
let
IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a page
to
aspnet_isapi.dll to let it handle security via a authentication ticket.
I can actually get the security part working fine but when the user has
rights to download the file, then asp.net tries to process the file (using
the default HttpHandler, i imagine) and everything crawls to a stop.
Ideally
I would like to send the page back to IIS for processing if asp.net
security
passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I use to
bring up the download dialog to the user and then download the file? ...or
do I need to create my own, and what would it look like?

Thanks

Earl

[Earl Teigrob]

Bruce,

Thanks...thats pretty much what I expected the answer to be. Do you have an
example for an HttpModule that just streams out the file?

Here is what I have so for but I need to know how to take the file input and
stream it to the output...

using System.Web;

namespace Handlers
{
public class DownloadHandler : IHttpHandler
{
public void ProcessRequest(HttpContext context)
{
//Take input and stream to output here...
}

public bool IsReusable{
get {return true;}
}
}
}

Thanks

Earl
"bruce barker" <no***********@safeco.com> wrote in message
news:e8**************@TK2MSFTNGP10.phx.gbl...

asp.net works by iis opening a pipe to the worker process. IIS then sends
the request to the worker process which pipe the response back.

IIS has special code to speed up downloads which you will lose, (and you
will be limited to about 200 downloads at a time), but you want to replace
the PAGE module with one of your own, that just streams out the file (after checking security). the easiest way is to to build a new vir dir for
downloads.
-- bruce (sqlwork.com)


"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:el**************@TK2MSFTNGP12.phx.gbl...

My company sells software and wants to provide downloadable product. Some

of

these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we

tested

it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and

let

IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a page

to

aspnet_isapi.dll to let it handle security via a authentication ticket.
I can actually get the security part working fine but when the user has
rights to download the file, then asp.net tries to process the file

(using the default HttpHandler, i imagine) and everything crawls to a stop.

Ideally

I would like to send the page back to IIS for processing if asp.net

security

passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I use to bring up the download dialog to the user and then download the file? ....or do I need to create my own, and what would it look like?

Thanks

Earl

[Earl Teigrob]

Ofter doing more research, I have come to the conclusion that there is not
way to stream large files though .NET without severe memory issues. (I would
love it if someone would prove me wrong but I don't think I am). If you are
up for it, writing a custom IIS ISAPI filter that interacts with a ASP.NET
HttpHandler will work, but requires a lot of knowledge (C++) and time. We
will probably end up buying a third party solution as is mentioned by Ken
Cox in this thread.

New Quote: "Sometimes you just hit the wall"

Earl
"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:%2****************@TK2MSFTNGP10.phx.gbl...

Bruce,

Thanks...thats pretty much what I expected the answer to be. Do you have an example for an HttpModule that just streams out the file?

Here is what I have so for but I need to know how to take the file input and stream it to the output...

using System.Web;

namespace Handlers
{
public class DownloadHandler : IHttpHandler
{
public void ProcessRequest(HttpContext context)
{
//Take input and stream to output here...
}

public bool IsReusable{
get {return true;}
}
}
}

Thanks

Earl
"bruce barker" <no***********@safeco.com> wrote in message
news:e8**************@TK2MSFTNGP10.phx.gbl...

asp.net works by iis opening a pipe to the worker process. IIS then sends

the request to the worker process which pipe the response back.

IIS has special code to speed up downloads which you will lose, (and you
will be limited to about 200 downloads at a time), but you want to replace the PAGE module with one of your own, that just streams out the file (after

checking security). the easiest way is to to build a new vir dir for
downloads.
-- bruce (sqlwork.com)


"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:el**************@TK2MSFTNGP12.phx.gbl...

My company sells software and wants to provide downloadable product. Some

of

these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we

tested

it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and let

IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a

page to

aspnet_isapi.dll to let it handle security via a authentication

ticket. I can actually get the security part working fine but when the user has rights to download the file, then asp.net tries to process the file

(using the default HttpHandler, i imagine) and everything crawls to a stop.

Ideally

I would like to send the page back to IIS for processing if asp.net

security

passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I

use to bring up the download dialog to the user and then download the file? ...or do I need to create my own, and what would it look like?

Thanks

Earl

[Guy Lukes]

Here is what I did to get over memory leaks in large downloads from a database.

Guy
myCommand.CommandTimeout = 0
myCommand.CommandText = sql
conn.Open()
reader = myCommand.ExecuteReader()
While reader.Read()
outputCount += 1
response.Write(reader("record") & nl)
'this is required to keep memory from leaking
If outputCount Mod 1000 = 0 Then
response.Flush()
memsize = GC.GetTotalMemory(True)
End If
End While

"Ken Cox [Microsoft MVP]" <BA************@sympatico.ca> wrote in message news:<uq**************@TK2MSFTNGP12.phx.gbl>...

If you have a solid budget, FileUPEE is a commercial product that supports
large downloads like that over HTTP. It believe it offloads processing of
the secure files.

www.softartisans.com
"Earl Teigrob" <ea******@hotmail.com> wrote in message
news:el**************@TK2MSFTNGP12.phx.gbl...

My company sells software and wants to provide downloadable product. Some
of
these downloads will be full CD's of over 550M

I had everything working fine using Response.filewrite() but when we
tested
it with large files, it blew up. (crashed the server, well documented
problem)

I can download a file just fine if I just point to the download file and
let
IIS generate the download dialog (but with no security, of course)

In order to add security, I set up IIS to forward the request for a page
to
aspnet_isapi.dll to let it handle security via a authentication ticket.
I can actually get the security part working fine but when the user has
rights to download the file, then asp.net tries to process the file (using
the default HttpHandler, i imagine) and everything crawls to a stop.
Ideally
I would like to send the page back to IIS for processing if asp.net
security
passes. Is there a way to do this? Can I create an HttpHandler that
basically sends the page back to IIS? If not, what HttpHandler to I use to
bring up the download dialog to the user and then download the file? ...or
do I need to create my own, and what would it look like?

Thanks

Earl