ASP.NET Directory Authentication

Question

I have a .net 2.0 application using Forms Authentication with AD and have a directory for documents which has been configured using a web.config file -

 <system.web>
    <authorization>
      <deny users="?"/>
      <allow roles="Security Alerts - Admin"/>
      <deny users="*"/>
    </authorization>
  </system.web>

When testing locally if I run the app and put the FQDN for a document /site/documents/Document1.pdf I am returned to the login page but when I have the site on a server I am able to open the PDFs without any problem. How can I force this so that if a user was to saves the URL of a document and tried to access it directly they would be forced to the login page to authenticate themselves first?

I have the same config for an ADMIN folder which includes aspx pages and works correctly and directs the users the Login page first, is it something to do with the doc type being a pdf as opposed to aspx pages.

Thanks in advance.

Answer 1

By default, .NET authentication does not work on static files such as pdfs.

You need to implement an HTTP Handler to serve your files if the user is authenticated.

It sound like your current authentication is set up and working correctly, so I won't go over the basics of setting that up.

Below is the relevant code which applies to your scenario taken from Kory Becker's helpful article here:

http://www.primaryobjects.com/2009/11/11/securing-pdf-files-in-asp-net-with-custom-http-handlers

You'll obviously have to alter the paths, namespaces and logic to suit your environment (eg IIS version) and/or specific file type requirements.

Step 1 - Create a FileProtectionHandler class which implements IHttpHandler

public class FileProtectionHandler : IHttpHandler
{
    public void ProcessRequest(HttpContext context)
    {
        switch (context.Request.HttpMethod)
        {
            case "GET":
            {
                // Is the user logged-in?
                if (!context.User.Identity.IsAuthenticated)
                {
                    FormsAuthentication.RedirectToLoginPage();
                    return;
                }

                string requestedFile = context.Server.MapPath(context.Request.FilePath);

                // Verify the user has access to the User role.
                if (context.User.IsInRole("Security Alerts - Admin"))
                {
                    SendContentTypeAndFile(context, requestedFile);
                }
                else
                {
                    // Deny access, redirect to error page or back to login page.
                    context.Response.Redirect("~/User/AccessDenied.aspx");
                }

                break;
            }
        }
    }

    public bool IsReusable { get; private set; }

    private HttpContext SendContentTypeAndFile(HttpContext context, String strFile)
    {
        context.Response.ContentType = GetContentType(strFile);
        context.Response.TransmitFile(strFile);
        context.Response.End();

        return context;
    }

    private string GetContentType(string filename)
    {
        // used to set the encoding for the reponse stream
        string res = null;
        FileInfo fileinfo = new FileInfo(filename);

        if (fileinfo.Exists)
        {
            switch (fileinfo.Extension.Remove(0, 1).ToLower())
            {
                case "pdf":
                {
                    res = "application/pdf";
                    break;
                }
            }

            return res;
        }

        return null;
    }
}

Step 2 - Add the following sections to your web.config file (with appropriate path/namespace modifications)

<httpHandlers>
...
<add path="*/User/Documents/*.pdf" verb="*" validate="true" type="CustomFileHandlerDemo.Handlers.FileProtectionHandler" />
</httpHandlers>

<system.webServer>
...
<handlers>
<add name="PDF" path="*.pdf" verb="*" type="CustomFileHandlerDemo.Handlers.FileProtectionHandler" resourceType="Unspecified" />
...
</handlers>
</system.webServer>