Is there a way to block images from being viewed if not loaded inside a page?

[darrel]

Is there a way to prohibit images from being viewed (linked directly to)
unless they are loaded from a page in my application?

I'm working on a project where one can create galleries of images. Some of
these galleries can be PWD protected. Of course, it's easy to protect the
ASPX files, but the images are just images, so one could send a link to a
specific image to someone outside of the secured gallery.

There's nothing terribly high-secure about these images, so it's not a huge
deal as it is, but if there's a way, I'd be interested in looking into it.

I know one option is to move the images outside the WWW folder and then
stream them to the user from a request, but that, obviously, won't allow one
to see the images on the pages themselves.

-Darrel

[casaubon]

You can map the .net process to handle images in iis under
configuration.
under home directory go to configuration add the .jpg extensin and map
it to aspnet_isapi.

[Jeff Dillon]

session_onstart

"darrel" <no*****@nowhere.com> wrote in message
news:uN****************@TK2MSFTNGP05.phx.gbl...

Is there a way to prohibit images from being viewed (linked directly to)
unless they are loaded from a page in my application?

I'm working on a project where one can create galleries of images. Some of
these galleries can be PWD protected. Of course, it's easy to protect the
ASPX files, but the images are just images, so one could send a link to a
specific image to someone outside of the secured gallery.

There's nothing terribly high-secure about these images, so it's not a
huge deal as it is, but if there's a way, I'd be interested in looking
into it.

I know one option is to move the images outside the WWW folder and then
stream them to the user from a request, but that, obviously, won't allow
one to see the images on the pages themselves.

-Darrel

[Darrel]

> You can map the .net process to handle images in iis under

configuration.
under home directory go to configuration add the .jpg extensin and map
it to aspnet_isapi.

What would that do, then...only grant permission to image access to IIS?

How doable is it to do this on Web host's shared servers (ie, not my
server)?

-Darrel

[Darrel]

> session_onstart

Hmm...sounds like to use that I need to then stream everything? Are their
cons to that method?

-Darrel

[Andrea]

Hello Darrel,

You can create your custom http_handler that manage a list of image that
can be viewed for free
or extending the idea a select on some datasource that return a boolean value
if image is available
without password.

Andrea

[casaubon]

If you install the mapping asp net form authentication will protect the
images in the same way it protects the pages. I would think the host
would be willing to work with you but i guess it depends on the
company.

I think that if you take andrees suggestion you will still need to map
the extension to aspnet_isapi.

Try it on your local to see how it works.

[Patrice]

>>, won't allow one to see the images on the pages themselves.

Apart from the other suggestions I'm not sure what you meant. If you use the
URL to this page in an IMG or whatever less HTML tag it works as expected...

--
Patrice

"darrel" <no*****@nowhere.com> a écrit dans le message de news:
uN****************@TK2MSFTNGP05.phx.gbl...

Is there a way to prohibit images from being viewed (linked directly to)
unless they are loaded from a page in my application?

I'm working on a project where one can create galleries of images. Some of
these galleries can be PWD protected. Of course, it's easy to protect the
ASPX files, but the images are just images, so one could send a link to a
specific image to someone outside of the secured gallery.

There's nothing terribly high-secure about these images, so it's not a
huge deal as it is, but if there's a way, I'd be interested in looking
into it.

I know one option is to move the images outside the WWW folder and then
stream them to the user from a request, but that, obviously, won't allow
one to see the images on the pages themselves.

-Darrel

[Jeff Dillon]

No, you don't need to stream. I just meant that you could force a redirect
in session_onstart so they couldn't load images unless they were logged in
properly

Jeff
"Darrel" <no*****@nospam.com> wrote in message
news:eI**************@TK2MSFTNGP05.phx.gbl...

session_onstart

Hmm...sounds like to use that I need to then stream everything? Are their
cons to that method?

-Darrel