Forms authentication doesn't work for downloads

[Peter Afonin]

Hello,

I'm using Forms authentication, and it works well. If user is not
authenticated, he is routed to the login page.

However, this doesn't work for downloads. If I have a file located in the
restricted area and put a direct link to it - anyone can download it.

Why is this? I expected that people would also be routed to the login
screen. How to make this happen?

I would appreciate your help.

Thank you,

--
Peter Afonin

[Teemu Keiski]

Forms Auth works only for those pages/file/resources which are processed by
ASP.NET by default. That is aspx,asmx, config and such. You can tweak that
in IIS (See Applications configuration for different file extensions like
where aspx is mapped to aspnet_isapi.dll) by having the custom file
extension mapped for aspnet_isapi.dll

See this blog post for detailed explanations:

Protect PDF, DOC and other file types with Forms Authentication
http://dotnetjunkies.com/WebLog/rich.../21/14215.aspx

--
Teemu Keiski
MCP, Microsoft MVP (ASP.NET), AspInsider
ASP.NET Forum Moderator, AspAlliance Columnist
http://blogs.aspadvice.com/joteke

"Peter Afonin" <pv*@speakeasy.net> wrote in message
news:%2****************@TK2MSFTNGP15.phx.gbl...

Hello,

I'm using Forms authentication, and it works well. If user is not
authenticated, he is routed to the login page.Protect PDF, DOC and other file types with Forms Authentication
However, this doesn't work for downloads. If I have a file located in the
restricted area and put a direct link to it - anyone can download it.

Why is this? I expected that people would also be routed to the login
screen. How to make this happen?

I would appreciate your help.

Thank you,

--
Peter Afonin

[John Timney \(ASP.NET MVP\)]

Forms authentication is handled by the framework - thus you likely need to
pass that type of file through the asp.net handler by mapping it in IIS...

--
Regards

John Timney
ASP.NET MVP
Microsoft Regional Director

"Peter Afonin" <pv*@speakeasy.net> wrote in message
news:%2****************@TK2MSFTNGP15.phx.gbl...

Hello,

I'm using Forms authentication, and it works well. If user is not
authenticated, he is routed to the login page.

However, this doesn't work for downloads. If I have a file located in the
restricted area and put a direct link to it - anyone can download it.

Why is this? I expected that people would also be routed to the login
screen. How to make this happen?

I would appreciate your help.

Thank you,

--
Peter Afonin

[Peter Afonin]

Thank you very much for your explanations!

Peter

"Teemu Keiski" <jo****@aspalliance.com> wrote in message
news:%2****************@TK2MSFTNGP15.phx.gbl...

Forms Auth works only for those pages/file/resources which are processed by ASP.NET by default. That is aspx,asmx, config and such. You can tweak that
in IIS (See Applications configuration for different file extensions like
where aspx is mapped to aspnet_isapi.dll) by having the custom file
extension mapped for aspnet_isapi.dll

See this blog post for detailed explanations:

Protect PDF, DOC and other file types with Forms Authentication
http://dotnetjunkies.com/WebLog/rich.../21/14215.aspx
--
Teemu Keiski
MCP, Microsoft MVP (ASP.NET), AspInsider
ASP.NET Forum Moderator, AspAlliance Columnist
http://blogs.aspadvice.com/joteke

"Peter Afonin" <pv*@speakeasy.net> wrote in message
news:%2****************@TK2MSFTNGP15.phx.gbl...

Hello,

I'm using Forms authentication, and it works well. If user is not
authenticated, he is routed to the login page.Protect PDF, DOC and other

file types with Forms Authentication

However, this doesn't work for downloads. If I have a file located in the restricted area and put a direct link to it - anyone can download it.

Why is this? I expected that people would also be routed to the login
screen. How to make this happen?

I would appreciate your help.

Thank you,

--
Peter Afonin