Securing a directory and its files with forms authentication

F

Frank

I have a simple asp.net 2.0 application that includes two components:

- a file uploader
- a lister of files that have been uploaded

Files are word processing documents; they get stored to a "papers"
subdirectory of the application.

It would be good if both the file lister *and* the files in "papers"
were secured. But I sense that IIS and asp.net do not work together
to protect documents that aren't aspx files.. For example, I put an
index.html file into the papers directory, and asked IIS for that
document, and was happily sent the document. This, despite a
<location path="papers"> section in my web.config that includes <deny
users="?" />.

I know how to secure a directory with IIS. What I didn't want to do
was secure both the listing.aspx component *and* the papers
directory. I suppose another approach would be to put the lister.aspx
file into the papers directory and secure the directory with IIS and
forget the authentication in asp.net. But that seems wrong.

So, maybe someone could tell me where my thinking's gone wrong.

Thank you very much.
 
D

Dominick Baier

Hi,

you have to map the file extensions you want to protect to the ASP.NET ISAPI
DLL

Go to IIS application properties and have a look to which DLL the .aspx extension
is mapped - now do the same for your docs.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

No members online now.

Forum statistics

Threads
473,743
Messages
2,569,478
Members
44,899
Latest member
RodneyMcAu

Latest Threads

Top