Disallow browsing to a file directly

Question

In an asp.net web forms site, I would like to disallow a user from browsing directly to files stored in a directory. For example, i have PDFs being stored in a directory, if the user knows the path, they can simply type it in the browser address bar and pull up the PDF.

Looking for ideas on how to stop that unless they are logged in under a specific id that matches the directory name.

Any ideas appreciated.

maybe if there is a way where i can detect if a .pdf is opening, could call c# code to do a check. Is that a custom handler? I'm not familiar. — jaykzoo, Aug 23 '18 at 21:05
What I do is to simply _not_ store those files below the website's root, but completely outside and use an [ASHX Generic Handler](https://stackoverflow.com/questions/2332579/what-is-generic-handler-in-asp-net-and-its-use) (WebForms) or a FileResult (MVC) to deliver the file to permitted users. — Uwe Keim, Aug 23 '18 at 21:14

score 0 · Answer 1 · answered Aug 23 '18 at 22:14

0

In IIS, go and select your Web Site, or even a specific application.

Then, nn the right side, you will find 'Directory Browsing' double-click and you will be able to disable/enable directory browsing.

answered Aug 23 '18 at 22:14

Majdi Saibi

435
6
13

score 0 · Answer 2 · answered Aug 23 '18 at 22:16

0

In your web.config file, add this:

<configuration>
  <location path="Secured">
    <system.webServer>
      <directoryBrowse enabled="false" />
    </system.webServer>
  </location>
</configuration>

answered Aug 23 '18 at 22:16

k1dev

631
5
14

score 0 · Answer 3 · answered Aug 23 '18 at 22:46

how to disable directory browsing unless they are logged in under a specific id

I assume this is ASP.NET Web Form.

If you use ASP.NET Membership Provider or Form Authentication, you could configure Authorization in web.config for all users and all files.

However, if users and files are constantly changing, above approach won't work.

That becomes complex. I store users and their authorized files in persistent storage like database. Then store the actual files in App_Data folder (or private blob storage). IIS wont' serve the files stored inside App_Data folder. Then every file request goes through Generic Handler such as FileHandler.ashx?filename=sample.pdf.

Disallow browsing to a file directly

3 Answers3