How can I allow logged in users be able to direct download file from an ASP.NET MVC application

Question

I have an ASP.NET MVC application and I want the logged in users be able to download some files inside application path, and avoid not logged in users to download files.

I want this folder to be in the root of project folder

Answer 1

It depends that how would you like to implement this scenario :

First scenario : you could put your download links inside these block of code, to prevent from showing to unauthorized users.

View page :

 @if (Utility.CheckActionPermission("ActionName", "ControllerName", "AreaName"))
            {
                 // your download link should be here               
            }

Controller :

public static bool CheckActionPermission(string actionName, string controllerName, string areaName)
    {
        var accessUrl = string.Concat(areaName, "/", controllerName, "/", actionName);
        return ((CustomPrincipal)HttpContext.Current.User).Access.Any(a => a.Url == accessUrl);
    }

Second scenario : Put all of your links freely to show to every user but you need to validate the user's authority when the download link clicked :

View:

@Html.ActionLink("File Name", "DownloadFile", "ControllerName", new { fileName= @Model.FileName }, null)

Controller

    [Authorize]
    public static bool DownloadFile(string fileName)
    {
        var filePath = Path.Combine(PathConstants.DownloadFolder, fileName);

        //some code to download the file 
    }