Securing URL in File Download in ASP.net

[anoop]

Hello,
There is a website in ASP.Net in which there is a File download
option with URL

English/Scripts/download.aspx?file=.... . Here the code substitutes the URL
of the file to download. but If I substitute the URL of the file that is
stored on the web server, then file such as aspx.vb or even web.config can be
downloaded by any user. Now I want to know how to protect this "file"
parameter in ASP.Net, so that only intended files can be downloaded.

Thank you

 

[Manish Bafna]

Hi,
You need to encrypt and decrypt querystring.Below link shows how to do it:
http://www.codeproject.com/aspnet/TamperProofQueryString.asp

 

[Guest]

Hello,
There is a website in ASP.Net in which there is a File download
option with URL

English/Scripts/download.aspx?file=.... . Here the code substitutes the URL
of the file to download. but If I substitute the URL of the file that is
stored on the web server, then file such as aspx.vb or even web.config can be
downloaded by any user. Now I want to know how to protect this "file"
parameter in ASP.Net, so that only intended files can be downloaded.

Thank you

Put files for download to a special folder (e.g. /download) and check
if requested file is located in that folder (avoid requests to other
folders)