web.config中的安全路径/文件夹

Question

I created a secure path in in my web-application.

like mention in this link : http://msdn.microsoft.com/en-us/library/ff648341.aspx

when i use the below config for secure my files:

<location path="Secure">
    <system.web>
      <customErrors mode="RemoteOnly" redirectMode="ResponseRewrite" defaultRedirect="error.html">
      </customErrors>
      <authorization>
        <deny users="?"/>
      </authorization>
    </system.web>
  </location>

the below files are not accessable without loign:

my host link /secure/xyz/01.doc    
my host link /secure/xyz/01.docx    
my host link /secure/xyz/01.xls    
my host link /secure/xyz/01.xlsx

but the below files are still accessable without login:

my host link /secure/xyz/01.pdf    
my host link /secure/xyz/01.txt    
my host link /secure/xyz/01.png

---

any idea about such a behaviour? why other than office document files are still accessable? i need to secure them.

Answer 1

While your web.config secured your web pages and certain files, the PDFs, like many other static files, are being served up directly by IIS.

You can force these other static files to go through the ASP.NET pipleline by adding StaticFileHandler entries in your web.config, in the handlers section.

<system.webServer>
  <handlers>
    <add name="PDFHandler" type="System.Web.StaticFileHandler" path="*.pdf" verb="GET"  />
    <add name="PNGHandler" type="System.Web.StaticFileHandler" path="*.png" verb="GET"  />
    <add name="TXTHandler" type="System.Web.StaticFileHandler" path="*.txt" verb="GET"  />
  </handlers>
</system.webServer>

I would guess though you already have something similar to this for your other office document types. Either in the web.config or in IIS.

Answer 2

got the solution.

After login, when click to download on the file having formate .pdf .png .txt,
Browser didnt download - but it shown in the same tab
(and browser cached it, i think so... Correct me if i Wrong!!!)
in case of .doc .xls it open the dialog to download (without caching).

After Logout, on browsing the download link of .pdf .png .txt
It opens it / load it from cache.
on the other hand, while surfing .doc .xls redirect me to login