Securing files for download.

[Steve Lloyd]

Hi,

I am trying to work out how I can secure files available for download on a
website.

I have forms authentication set and can deny access to aspx file in a
directory using the web.config file which redirects to the login page and
works fine, however, if i have a downloadable in this directory people can
enter the URI of the file and download it without any login. I understand
that the web.config approach only secures .Net based resources but would
like to know if anyone has a solution/work around for this. I have thought
about storing the files in SQL which would require an aspx page to
authenticate to the server, I think this would work but SQL space costs much
more than web space ..

The webserver is a shared hosting solution so i do not have acces to the
windows level accounts.

Would appreciate some direction on this.

Thanks very much

Steve

[Joe Audette]

?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ????????????????????????????????????????????.????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ????????????????????>

[Joe Audette]

I did not post all those question marks. Not sure what
happened but I posted some code that I thought would help.
I recommend storing the download files outside the web
and open them with a binary stream and use
Response.BinaryWrite to return them. Too bad it lost the
code I posted.

[Luis Centeio]

hello Steve

An excellent article on that subject

is at
[url]http://www.wwwcoder.com/main/parentid/259/site/1795/68/default.aspx[/url]

Hoppe that suite to you

Luis Centeio

"Steve Lloyd" <steveRemoveThisNow@livenowpaylater.co.uk> wrote in message
news:OF9mizovDHA.2080@TK2MSFTNGP10.phx.gbl...

> Hi,
>
> I am trying to work out how I can secure files available for download on a
> website.
>
> I have forms authentication set and can deny access to aspx file in a
> directory using the web.config file which redirects to the login page and
> works fine, however, if i have a downloadable in this directory people can
> enter the URI of the file and download it without any login. I understand
> that the web.config approach only secures .Net based resources but would
> like to know if anyone has a solution/work around for this. I have

thought

> about storing the files in SQL which would require an aspx page to
> authenticate to the server, I think this would work but SQL space costs

much

> more than web space ..
>
> The webserver is a shared hosting solution so i do not have acces to the
> windows level accounts.
>
> Would appreciate some direction on this.
>
> Thanks very much
>
> Steve
>
>

[Petr PALAS]

Hi Steve,

when you set the IIS to process all files using ASPNET_ISAPI.dll as it does
with ASPX files. Then you can check if user is authenticated and authorized
in the following event:

Sub Application_AcquireRequestState(ByVal sender As Object, ByVal e As
EventArgs)
'... your code ....
End Sub

You can find a more detailed description in the documentation of PortSight
Secure Access for .NET (you don't need the component to work this out:

[url]http://www.portsight.com/downloads/SecureAccess/1_1/Standard/Secure%20Access%20Guide.chm[/url]

Best Regards,

Petr PALAS, [email]petrp@portsight.com[/email]
PortSight - Portals & Components, [url]www.PortSight.com[/url]




"Steve Lloyd" <steveRemoveThisNow@livenowpaylater.co.uk> wrote in message
news:OF9mizovDHA.2080@TK2MSFTNGP10.phx.gbl...

> Hi,
>
> I am trying to work out how I can secure files available for download on a
> website.
>
> I have forms authentication set and can deny access to aspx file in a
> directory using the web.config file which redirects to the login page and
> works fine, however, if i have a downloadable in this directory people can
> enter the URI of the file and download it without any login. I understand
> that the web.config approach only secures .Net based resources but would
> like to know if anyone has a solution/work around for this. I have

thought

> about storing the files in SQL which would require an aspx page to
> authenticate to the server, I think this would work but SQL space costs

much

> more than web space ..
>
> The webserver is a shared hosting solution so i do not have acces to the
> windows level accounts.
>
> Would appreciate some direction on this.
>
> Thanks very much
>
> Steve
>
>