如何防止直接访问ASP.NET MVC中的图像？

Question

I need the same thing as this guy here:

http://forums.asp.net/t/1507682.aspx

The thing is that the answer he marked as correct doesn't work for me. I am using ASP.NET MVC3 soon to be migrated to MVC4 and Windows Server 2012. I want to prevent direct access to some images because of security issues. It's not Image Leeching protection I'm worried at this moment, I read several articles on how to do that.

If the link is on my page like this

<img src="/Content/Images/img1.jpg" />

The image should be shown, but not if it is directly accessed:

http://mywebsite.com/Content/Images/img1.jpg

Since we're talking about images and several people accessing it, a solution that considers performance issue would be my way to go.

Any ideas on how to implement that?

Thanks.

Answer 1

Write an Action method which reads the image from disk / db and render it. In that action method, you may check whether the user is authorized or not and return the appropriate image or a "not authorized" image.

public class ProductController : Controller
{
  public ActionResult Photo(string id)
  {
   // TO DO:  get image using the unique id passed and render it
  }
}

You can use the path to this action method as your image path.

<img src="@Url.Action("Photo","Product")/someUniqueIDOfPhotoFromYourDB" />

This approach will have a slight performance impact compared to serving image directly from disk.

Answer 2

You probably want to think outside MVC and handle hotlinking in IIS itself . IIS has the tools (the referer (sic) header) to figure out whether or not an image request appears to have come from inside your site or not.