file restriction - Forms authentication

[Ed]

Hi,

I'm have an asp.NET project, and I'm using Forms authentication method. I was wondering if there is a way to deny access to files that are not .aspx...ie: Someone who tries to access somepage.aspx is prompted for a username and password. However, if someone tries to access somefile.pdf, he can do this without authentication.

Any Suggestions?

Thanks,

Ed

[Jim Cheshire [MSFT]]

RE: file restriction - Forms authentication

Hi Ed,

Only those file types that are mapped in IIS to the aspnet_isapi.dl l are
going to be processed by Forms authentication. You have a couple of
options when it comes to PDF files.

1. Have an ASPX page that authenticates and then streams the PDF to the
browser via Response.Binary Write.
2. Map the PDF file type to the aspnet_isapi.dl l in IIS.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
jamesche@online .microsoft.com

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------[color=blue]
>Thread-Topic: file restriction - Forms authentication
>thread-index: AcRHRzUlZFxlqk6 eRWu5C6EeDelK+Q ==
>X-WN-Post: microsoft.publi c.dotnet.framew ork.aspnet
>From: "=?Utf-8?B?RWQ=?=" <anonymous@disc ussions.microso ft.com>
>Subject: file restriction - Forms authentication
>Date: Mon, 31 May 2004 12:41:03 -0700
>Lines: 9
>Message-ID: <86150CEC-421A-4B69-846B-5F5AE3F72D25@mi crosoft.com>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="Utf-8"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>Content-Class: urn:content-classes:message
>Importance: normal
>Priority: normal
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
>Newsgroups: microsoft.publi c.dotnet.framew ork.aspnet
>Path: cpmsftngxa10.ph x.gbl
>Xref: cpmsftngxa10.ph x.gbl microsoft.publi c.dotnet.framew ork.aspnet:2373 15
>NNTP-Posting-Host: tk2msftcmty1.ph x.gbl 10.40.1.180
>X-Tomcat-NG: microsoft.publi c.dotnet.framew ork.aspnet
>
>Hi,[/color]

I'm have an asp.NET project, and I'm using Forms authentication method. I
was wondering if there is a way to deny access to files that are not
..aspx...ie: Someone who tries to access somepage.aspx is prompted for a
username and password. However, if someone tries to access somefile.pdf,
he can do this without authentication.

Any Suggestions?

Thanks,

Ed[color=blue]
>[/color]