asp.net c＃仅使用全局asax将文件夹访问限制为登录的用户

Question

I am trying to discipline users and also search engines not to be anywhere near a folder where logged in users are uploading files and only logged in users have access to view files. I must be using global asax setting to achieve this as any other method such as Membership framework has become too late in my life. When a users logs in a session(thisuser) is fired - so I tried many variations of this:

protected void Application_PreRequestHandlerExecute(object sender, EventArgs e) 
    {
        string url = HttpContext.Current.Request.Url.AbsoluteUri;
         url = url.ToUpper();
         if (System.Web.HttpContext.Current.Session == null && url.Contains("CONFIDENTIAL"))

        {                
                Response.Redirect("Login.aspx");                                
        }

        if (System.Web.HttpContext.Current.Session != null && url.Contains("CONFIDENTIAL"))
        {                    
            if (Session["THISUSER"].ToString() != "OK")
            {
                Response.Redirect("Login.aspx ");
            }                                
        }
    }

//I tried  using below also with pretty much same logic as above 

     void Application_BeginRequest(object sender, EventArgs e)

//and also

      void Application_AcquireRequestState(object sender, EventArgs e)

Notwithstanding my tireless efforts, global asax in not cooperating at all ; and all my pleas to global asax are falling on deaf ears resulting in (1) access to all users (2) or System.NullReferenceException. What do I do so that global asax starts listening to me? Please advise.

Answer 1

Typo in your code (May not be the only cause to the problem, but you should try)

protected void Application_PreRequestHandlerExecute(object sender, EventArgs e) 
    {
        string url = HttpContext.Current.Request.Url.AbsoluteUri;
         url = url.ToUpper();
         if (System.Web.HttpContext.Current.Session == null && url.Contains("CONFIDENTIAL"))

        {                
                Response.Redirect("Login.aspx");                                
        }

        if (System.Web.HttpContext.Current.Session != null && url.Contains("CONFIDENTIAL"))
        {                    
            if (Session["THISUSER"].ToString() != "OK")
            {
                Response.Redirect("Login.aspx");
            }                                
        }
    }

Answer 2

A NullReferenceException will occur if "THISUSER" is not present in session. You should also use ToUpperInvariant() on strings.

I'm not convinced this is actually a secure solution however.