Securing access to other files in an ASP.NET application

[NWx]

Hi,

I have an ASP.NET app with forms security.
User are allowed to upload files (which are "attached" to user accounts in
database)
Documents are saved in a subfolder of the application, then in a
sub-subfolder with the same name as user account.

For example, for user jo, the document will be saved in
documents/jo/a_picture.jpg
Then after logon, user can see all his attached documents in a datagrid,
with a link to open/download

But, if user remember the url without being logged in, and type it into the
browser's address bar, he/she can open / download the document.

How can I extend the security features of ASP.NET form's security to protect
not only ASPX pages, but also all other documents in application's virtual
folder and subfolders?

Thank you

 

[Steve C. Orr [MVP, MCSD]]

If you store your files in SQL Server then you can let it handle most of
these details.
Here's further information on that techique:
http://www.aspnetpro.com/features/2003/07/asp200307so_f/asp200307so_f.asp

Otherwise you'll probably store your restricted files in a private folder
and use Response.Writefile once you've determined the user is authorized:
http://msdn.microsoft.com/library/d...fsystemwebhttpresponseclasswritefiletopic.asp

 

[NWx]

Hi,

Otherwise you'll probably store your restricted files in a private folder
and use Response.Writefile once you've determined the user is authorized:

http://msdn.microsoft.com/library/d...fsystemwebhttpresponseclasswritefiletopic.asp

So, to use this technique, instead of putting an hardcoded anchor in my
template column, should I put a hyperlink button with appropriate
parameters, so when user click it, it will trigger a server-side event which
will execute a response.writefile, passing the desired file back to browser?

How can I make a folder restricted? Should I do this using WinNT folder
security features, or put it outside of virtual web folder (in a folder not
accessible from the web site)?

Which approach will be better?

Thank you very much for your answer.

 

[Steve C. Orr [MVP, MCSD]]

Yes, you've got the idea.
Standard windows file/folder permissions should be sufficient to protect the
files from direct access.

 

[NWx]

Thank you for your answer

Regards

Yes, you've got the idea.
Standard windows file/folder permissions should be sufficient to protect the
files from direct access.

--
I hope this helps,
Steve C. Orr, MCSD, MVP
http://Steve.Orr.net



http://msdn.microsoft.com/library/d...fsystemwebhttpresponseclasswritefiletopic.asp