Secure File Delivery in Web App problem...questions...

[Guest]

Hello - I am not sure of the best way to solve this problem:

In my web app I need to delivery both static and dynamically generated files
to end-users. These files should not be accessable to users via "url
hacking". The files are of various file types (e.g. TXT; PDF; CSV; DOC;
ZIP; etc...) -

The two approaches I can conceive of offhand are both problematic--

(1) use SQL server BLOB field to store the files. Though I dont know if all
of these types are able to be stored in SQL server's BLOB, especially ZIP?
And if so, how to stream the files from the database to the client with
different formats?

(2) develp some sort of component that can retrieve the files from a secure
directory not web accessible and stream them to the client...The production
web server is clustered (not using appserver/DFS) so where does this
component reside and how to orchestrate the file delivery? How to stream
files such as PDF and ZIP?

----

I understand that these questions and all the nuances of
design/implementation cannont readily be addressed here - but I sure would
appreciate some input...I am sure that others have struggled with (ok, so
maybe I struggle with it) -- I am sure that other more experienced and gifted
folks have worked on this problem...

Any thoughts, insights, tips, tricks, or even a happy anecdote would be very
much appreciated.

Cheerio!

TIA.

 

[David Alpert]

Take a look at IHttpHandler. If you develop a class that implements
this method, you can restrict downloads to specific file types and
obscure the actual URL by hard-coding path roots.

See the following MSDN article:
http://msdn.microsoft.com/msdnmag/issues/02/09/HTTPPipelines/default.aspx