使用处理程序限制未经授权的文件下载访问

Question

I am working on a website where the images and other files are handled by a handler named resources.ashx. These files are not stored in any folder but are fetched from database.

The problem is the access to some of the files is restricted, whereas some images and files are open to all.

Lets say the path to one of the restricted image is :

../website/resources.ashx/restrictedimage.jpg

If an unauthenticated user types in this url, he will have access to the image straight away. I want to restrict that.

PS -> I can't change the handler as I am referencing it from some other project.

Answer 1

May be an HttpModule can help you out. Handle the AuthenticateRequest event, parse/compare requested url and users/roles.

Answer 2

You can use authorization rules in your web.config to control access to the files (ie urls) or your choosing based on user/group membership. See: using multiple authorization elements in web.config