Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an IIS(v6)/Windows 2003/.Net 3.5(app code, libraries etc.) server hosting a website at mapped to E:\Inetpub\wwwroot\mywebsite, we also have a virtual directory (VirtDir) mapped out to E:\Inetpub\wwwroot\mywebsite\files (although in theory this could be in a different directory or a separate machine) where we store a customer's files(a bunch of .pdf & .xls). Currently to access a file you can enter into the url something like: and get access to the file.

The problem is the user doesn't have to log into to get access to the file, we would prefer them to log in first. We would like the user to login via the mywebsite and if valid, let them download files from the virtual directory. The and VirtDir are separate sites on the same farm. Allow Anon Access, and Integrated Windows Authentication both enabled.

I'm more of a developer and less of a Sys Admin, but hopefully I'm in the right spot, any help would be appreciated.

share|improve this question
up vote 0 down vote accepted

Usually in these cases I would serve the file up through a controller in the web application such as:

dl.aspx would then handle the authentication requirements and redirect to login if needed. If authenticated, it would look up the file, find it on disk, read it in and then return the contents to the visitor after setting the appropriate response headers for mime/type and filename (via Content-Disposition). There are other ways to approach this, but I've generally found this to be the path of least resistance for IIS.

share|improve this answer
That sounds like a good idea, and definitely worth pursuing. Following what you're saying, I'd want to only let the VirtDir respond to requests if they came from mywebsite. Correct? – Chris L Jun 14 '10 at 20:31
If you're imposing some form of authentication in your web application, you would use the same logic within the download controller, in which case it shouldn't matter where they "come from" as long as they have a valid authentication token. – Justin Scott Jun 14 '10 at 21:08
Thanks for the help, I think I got enough to come up with a plan. – Chris L Jun 14 '10 at 21:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.