1

I have an Internet website running on IIS/Windows configured as follows:

  • The website is publicly accessible for visitors to browse.
  • A user can login and upload files.
  • The user will be able to see their files, but not another user's files.
  • After the files are uploaded they are stored in a directory in the website.

If someone has the full Url to the file e.g. http://website.com/files/13212132.jpg how can I prevent the file from being accessed by people other then the user who uploaded the file?

Any insights will be appreciated.

Improve this question
2
  • Can you clarify if you mean: 1. that your website accepts files from the "general public" but they should be able to see them after they have been uploaded. 2. Your website is published on the Internet but you only want authenticated users to access the website.
    – Bernie White
    Oct 15, 2014 at 8:17
  • Hi Bernie - 1. Yes, exactly. 2. Not entirely. Any visitor should be able to browse. The issue is, the files uploaded should be visible to users who uploaded them. But, a hacker should not be able to access the file if by chance he happens to have a link to the file url.
    – Dinesh
    Oct 15, 2014 at 9:05

2 Answers 2

Reset to default
1

The best way is to not serve the files directly at all, but serve them via a handler. This way you can store the files wherever you like, (which has advantages of its own, and not just security advantages) and the handler can process both authentication and authorization checks before making the decision as to whether it should present the file to the user or not.

Improve this answer
0

One option is to password protect the folder. This is using IIS 7 as an example:

  1. Open IIS Manager (start >> run >> inetmgr.msc)
  2. Go to the website where you want to password protect the folder.
  3. Click on the folder that you want to set to require a password.
  4. Double Click on Authentication, Disable Anonymous Authentication.
  5. Enable Basic Authentication.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .