Securing files for download.

[Steve Lloyd]

Hi,

I am trying to work out how I can secure files available for download on a
website.

I have forms authentication set and can deny access to aspx file in a
directory using the web.config file which redirects to the login page and
works fine, however, if i have a downloadable in this directory people can
enter the URI of the file and download it without any login. I understand
that the web.config approach only secures .Net based resources but would
like to know if anyone has a solution/work around for this. I have thought
about storing the files in SQL which would require an aspx page to
authenticate to the server, I think this would work but SQL space costs much
more than web space ..

The webserver is a shared hosting solution so i do not have acces to the
windows level accounts.

Would appreciate some direction on this.

Thanks very much

Steve

 

[Joe Audette]

??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????.???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????>

 

[Joe Audette]

I did not post all those question marks. Not sure what
happened but I posted some code that I thought would help.
I recommend storing the download files outside the web
and open them with a binary stream and use
Response.BinaryWrite to return them. Too bad it lost the
code I posted.

 

[Luis Centeio]

hello Steve

An excellent article on that subject

is at
http://www.wwwcoder.com/main/parentid/259/site/1795/68/default.aspx

Hoppe that suite to you

Luis Centeio

 

[Petr PALAS]

Hi Steve,

when you set the IIS to process all files using ASPNET_ISAPI.dll as it does
with ASPX files. Then you can check if user is authenticated and authorized
in the following event:

Sub Application_AcquireRequestState(ByVal sender As Object, ByVal e As
EventArgs)
'... your code ....
End Sub

You can find a more detailed description in the documentation of PortSight
Secure Access for .NET (you don't need the component to work this out:

http://www.portsight.com/downloads/SecureAccess/1_1/Standard/Secure Access Guide.chm

Best Regards,

Petr PALAS, (e-mail address removed)
PortSight - Portals & Components, www.PortSight.com