Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP General > Securing attachments,e.g., .pdf, .doc, .xls through web.config

Reply
Thread Tools

Securing attachments,e.g., .pdf, .doc, .xls through web.config

 
 
win2kcowboy
Guest
Posts: n/a
 
      05-25-2005
Using VS2003, ASP.NET 1.1

Is it possible to secure files normally placed as attachments (such as word
docs etc.) and often placed in attachment directories within your web
application, using FORMS authentication and web.config and NOT using Active
Directory/NTFS persmissions (_all_ users will come in under the ASPNET user
account at the AD/NTFS level).

I am familiar with the fact that placing the following few lines into
web.config within a child directory, e.g., one of those "attachment
directories," effectively secures the files within from the general public
(if someone were to type the attachment URL out in an attempt to bypass the
home page, they would be kicked back to a login page):
<configuration>

<system.web>

<authorization>

<deny users="?"/>

</authorization>

</system.web>

</configuration>.

That is great if you have one level of security but what if your web
application uses multiple levels of security, e.g., member, leader,
president, etc whereby some documents are meant for one level of user but not
the others (let alone the general public)? It seems as if the web.config
file has "authenticated" and "not-authenticated" states only.

I know that one can set more restrictive NTFS persmissions on the resources
and have the user log in to some pages using integrated windows security but
that becomes unwieldy with hundreds/thousands of users who would probably not
manage their AD account very well anyway. I would like to stick with a
simple FORMS based authentication native to the web application using a
database back end.

ASPX pages themselves can be secured programmatically:
If Page.User.IsInRole("President") Then
'do something like
else
Message.text = "You must be a president to view this page" 'Hide content
fields.

But what of files such as .doc, .pdf, .xls and other files often used to
deliver substantive report content? Effectively, lower level users can bypass
your web application security by simply typing out the URL to the file in
question after logging in themselves.

Is there a way for the web.config to intercept such users and kick them back
to a login or other page?

I know that individual users, roles, can be specified in the web.config
"allow", "deny" statements but the accounts these statements reference are
either Local machine or Domain (active directory) accounts not married to the
web application.

Thanks for any help. If someone can direct me to an article on this topic
as well I would appreciate it.
 
Reply With Quote
 
 
 
 
Ray Costanzo [MVP]
Guest
Posts: n/a
 
      05-25-2005
http://www.aspfaq.com/5002

Ray at work

"win2kcowboy" <> wrote in message
news:55534B3F-09F4-4B66-BFAC-...
> Using VS2003, ASP.NET 1.1



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Securing Wireless Network w/ certificates and no user intervention? jsoupene@cox.net Wireless Networking 5 02-22-2005 09:51 PM
Securing laptop for park-bench hot spots (newbie question) David D. Wireless Networking 3 01-19-2005 07:12 AM
other question about securing wireless lcvd1@yahoo.com Wireless Networking 3 12-06-2004 02:03 AM
Securing network anon Wireless Networking 2 11-16-2004 02:40 AM
having trouble securing my wireless laptop FireBrick Wireless Networking 2 08-10-2004 12:37 PM



Advertisments
 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57