restrict access to doc files asp.net

Question

i have a folder in my asp.net app conatining doc files that can be accessed only (dowwload) by a certain type of connected users(admin account or permitted other accounts)

how can i do that?
any ideas?
thanks in advance.

Answer 1

The App_Data folder in .NET is protected, and therefore ideal for this very purpose. I normally put sensitive files in here then have a page "ViewDoc.aspx" that performs the security checks and then sends the file to the user (using Response.Write).

Answer 2

Put sensitive files outside of web site root, so they can not be accessed by URL.

After that, use this HttpHandler (written in VB.NET) to serve files:

Public NotInheritable Class FileHandler
    Implements IHttpHandler

    Public ReadOnly Property IsReusable() As Boolean Implements System.Web.IHttpHandler.IsReusable
        Get
            Return False
        End Get
    End Property

    Public Sub ProcessRequest(ByVal context As System.Web.HttpContext) Implements System.Web.IHttpHandler.ProcessRequest
        If Not String.IsNullOrEmpty(context.Request.QueryString("FileName")) Then
            Dim fileName As String = context.Request.QueryString("FileName")

            Try


                Dim filesPath As String = "D:\TheFiles\"

                Dim fileInfo As New IO.FileInfo(filesPath & fileName)

                If fileInfo.Exists Then

                    Dim fileExt As String = fileInfo.Extension.Remove(0, 1).ToUpperInvariant


                    If fileExt = "JPG" Then
                        context.Response.ContentType = "image/jpeg"
                    Else
                        context.Response.ContentType = "image/" & fileExt
                    End If

                    context.Response.TransmitFile(fileInfo.FullName)

                End If

            Catch ex As Exception
            End Try

        End If
    End Sub

End Class

and register this handler in your web.config like this:

<httpHandlers>
        <add verb="*" path="secfile.axd" type="MyApp.FileHandler, MyApp" validate="false"/>
    </httpHandlers>

use like this:

<a href="secfile.axd?pic=sample.jpg" />

Remember adding your file types to handler and change response.contenttype by type of your file.

Using a handler is not the only way, you can use context.Response.TransmitFile(fileInfo.FullName) in your aspx file.

Answer 3

A simple way to do this is to NOT put these documents inside a folder of your ASP.NET app and instead, put it somewhere else in the file system that can't be accessed directly from the browser. Then programmatically, you can serve the file to the user if s/he's authorized to do so.