Limiting access to user files

[Dave Taylor]

I have an old ASP application that I'm converting to ASPNET. The
application allows users to login, enter data, and run simulations on our
computers and the results are stored in a file the user then downloads. In
order to allow users to access only their files, in ASP I used to copy the
files to a temporary directory, allow the user to download them, then delete
the temp directory. I'm looking for a better way to do this. The user
login data is stored in a SQL Server database, and so using Windows-based
security doesnt work. Any ideas???

Thanks

Dave Taylor
Process Engineering Resources, Inc.

[Peter O'Reilly]

Here's on idea. If you are storing user login data in a SQL Server
database, why not do the same for the files? Specifically store the path of
the file (e.g. not its contents) in the database and have it related to some
user id or security credentials.

--
Peter O'Reilly

[Steve C. Orr [MVP, MCSD]]

You're right, the temp directory is not a very good approach.
Instead, store these files in a database or a secured directory.
Then you can take manual control of them and only dish them out when you
choose by using functions such as Response.WriteFile
http://msdn.microsoft.com/library/de...efiletopic.asp

Here's another link that details storing the files in SQL Server:
http://www.aspnetpro.com/features/20...200307so_f.asp

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net
"Dave Taylor" <no*********@processeng.com> wrote in message
news:Oi**************@TK2MSFTNGP11.phx.gbl...

I have an old ASP application that I'm converting to ASPNET. The
application allows users to login, enter data, and run simulations on our
computers and the results are stored in a file the user then downloads. In order to allow users to access only their files, in ASP I used to copy the
files to a temporary directory, allow the user to download them, then delete the temp directory. I'm looking for a better way to do this. The user
login data is stored in a SQL Server database, and so using Windows-based
security doesnt work. Any ideas???

Thanks

Dave Taylor
Process Engineering Resources, Inc.

[bruce barker]

you can use an httpmodule for this. you will have to map the extenstion of
the file to your module, so there is a little overhead in download because
of the asp.net processing.

if performance is key, write an isapi filter. C++ has wizards for this now.

-- bruce (sqlwork.com)

"Dave Taylor" <no*********@processeng.com> wrote in message
news:Oi**************@TK2MSFTNGP11.phx.gbl...

I have an old ASP application that I'm converting to ASPNET. The
application allows users to login, enter data, and run simulations on our
computers and the results are stored in a file the user then downloads. In order to allow users to access only their files, in ASP I used to copy the
files to a temporary directory, allow the user to download them, then delete the temp directory. I'm looking for a better way to do this. The user
login data is stored in a SQL Server database, and so using Windows-based
security doesnt work. Any ideas???

Thanks

Dave Taylor
Process Engineering Resources, Inc.

[Kevin Spencer]

You could always use an ASPX page to deliver the documents to the end user.
The documents could remain in a protected folder, and an ASPX page could be
used to open the file and stream it to the browser dynamically.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.

"Dave Taylor" <no*********@processeng.com> wrote in message
news:Oi**************@TK2MSFTNGP11.phx.gbl...

I have an old ASP application that I'm converting to ASPNET. The
application allows users to login, enter data, and run simulations on our
computers and the results are stored in a file the user then downloads. In order to allow users to access only their files, in ASP I used to copy the
files to a temporary directory, allow the user to download them, then delete the temp directory. I'm looking for a better way to do this. The user
login data is stored in a SQL Server database, and so using Windows-based
security doesnt work. Any ideas???

Thanks

Dave Taylor
Process Engineering Resources, Inc.

[Kevin Spencer]

You could always use an ASPX page to deliver the documents to the end user.
The documents could remain in a protected folder, and an ASPX page could be
used to open the file and stream it to the browser dynamically.

--
HTH,
Kevin Spencer
..Net Developer
Microsoft MVP
Big things are made up
of lots of little things.

"Dave Taylor" <no*********@processeng.com> wrote in message
news:Oi**************@TK2MSFTNGP11.phx.gbl...

I have an old ASP application that I'm converting to ASPNET. The
application allows users to login, enter data, and run simulations on our
computers and the results are stored in a file the user then downloads. In order to allow users to access only their files, in ASP I used to copy the
files to a temporary directory, allow the user to download them, then delete the temp directory. I'm looking for a better way to do this. The user
login data is stored in a SQL Server database, and so using Windows-based
security doesnt work. Any ideas???

Thanks

Dave Taylor
Process Engineering Resources, Inc.