Securing a directory and its files with forms authentication
- From: Frank <fburleigh@xxxxxxxxx>
- Date: Tue, 15 Apr 2008 13:27:49 -0700 (PDT)
I have a simple asp.net 2.0 application that includes two components:
- a file uploader
- a lister of files that have been uploaded
Files are word processing documents; they get stored to a "papers"
subdirectory of the application.
It would be good if both the file lister *and* the files in "papers"
were secured. But I sense that IIS and asp.net do not work together
to protect documents that aren't aspx files.. For example, I put an
index.html file into the papers directory, and asked IIS for that
document, and was happily sent the document. This, despite a
<location path="papers"> section in my web.config that includes <deny
users="?" />.
I know how to secure a directory with IIS. What I didn't want to do
was secure both the listing.aspx component *and* the papers
directory. I suppose another approach would be to put the lister.aspx
file into the papers directory and secure the directory with IIS and
forget the authentication in asp.net. But that seems wrong.
So, maybe someone could tell me where my thinking's gone wrong.
Thank you very much.
.
- Follow-Ups:
- Re: Securing a directory and its files with forms authentication
- From: Dominick Baier
- Re: Securing a directory and its files with forms authentication
- Prev by Date: Re: System.Net.Cookie vs System.Web.Cookie
- Next by Date: GC.Collect() not cleaning memory, how to find out what references to lots of memory still exist?
- Previous by thread: url rewriting and authentication
- Next by thread: Re: Securing a directory and its files with forms authentication
- Index(es):
Relevant Pages
|
