IIS虚拟文件夹URL加密

Question

We have ac# asp.net web application that, amongst other things, allows users to download previously uploaded files such as PDF's, Word docs etc. The asp.net app is served up via an IIS6 server and the file resources live on a different server.

When the user requests a file (ie click a button on the web form), we stream the file back to their browser, changing the ContentType appropriately.

This seemed a good way to avoid going down the IIS virtual folder route to serve up the file resources - which we had concerns about due to the potential for users to hack the URL. ie with a URL like https://mydomain/myresource/clientid/myreport.docx , a savvy user could have a good stab at guessing alternative cvlientid's and document names.

The trouble with streaming a Word document to the browser is that when the browser throws it at Word, Word treats it as a brand new doc, which means the original document's properties & margin info is lost.

Our users store metadata information in the Word doc properties, so this solution is not acceptable to them.

Serving up via IIS virtual folders solves that problem, but introduces the URL security problem.

So my questions are ...

Does anyone know how we can use URL encryption/decryption (or obfuscation) with IIS Virtual folders?
Or does anyone know of any open source projects that do a similar job.
Or does anyone have any sugestions on how to go about writing our own implementation of Virtual folders but with encrypted URLs?

Many thanks in advance.

ps. our web app is delivered over https

Answer 1

Sorry guys, in my question, I have made some incorrect assumptions.

What am I trying to do is persist the properties stored on a word document when they are delivered from server (using either Response.TransmitFile or via a virtual folder) to a client browser.

I set up a test scenario with an IIS virtual folder and dropped a docx file (that I know contains info in the title & subject properties) in my virtual folder's physical path.

I pointed my browser at the virtual folder alias and the browser popped up its message to either open or save the doc.

If I choose to save it, the saved docx still has the properties intact.

If I choose to open it fist and then save it from Word, the saved docx has lost the properties.

So I think I need to post a different question!

Answer 2

You may find that the ClaimsAuthorizationManager class in "Windows Identity Foundation" does what you want. You get to implement whatever logic you like to determine who can download what without using "directory security".