Security content in Virtual Directory

[Beryl Small]

I have a .NET web application that uses forms
authentication. There are CBTs in a virtual directory on
the IIS server. I do not want users logging into to the
website to be able to navigate to the virtual folder and
start any of the CBTs. The CBTs should only be able to be
accessed throught a redirection from an .aspx page in my
application. Is there any way to do this

 

[Eric Marvets]

What I would do is place the CBTs in a directory not accessable via the web,
but that the ASPNET account had access to and stream the content to the
user. Beware that garbage collection is not a fan of large objects, so I
would stream (don't use the default of buffering) the content in 50kb chunks
to avoid any memory issues.

Let me know if you need a quick code sample.

--
Eric Marvets
Principal Consultant

the bang project

<shameless self promotion>

Email (e-mail address removed) for Information on Our Architecture and
Mentoring Services

</shameless self promotion>