0

I have an IIS(v6)/Windows 2003/.Net 3.5(app code, libraries etc.) server hosting a website at www.mywebsite.com mapped to E:\Inetpub\wwwroot\mywebsite, we also have a virtual directory (VirtDir) mapped out to E:\Inetpub\wwwroot\mywebsite\files (although in theory this could be in a different directory or a separate machine) where we store a customer's files(a bunch of .pdf & .xls). Currently to access a file you can enter into the url something like: www.mywebsite.com/VirtDir/Customer/myFile.pdf and get access to the file.

The problem is the user doesn't have to log into www.mywebsite.com to get access to the file, we would prefer them to log in first. We would like the user to login via the mywebsite and if valid, let them download files from the virtual directory. The www.mywebsite.com and VirtDir are separate sites on the same farm. Allow Anon Access, and Integrated Windows Authentication both enabled.

I'm more of a developer and less of a Sys Admin, but hopefully I'm in the right spot, any help would be appreciated.

1 Answer 1

0

Usually in these cases I would serve the file up through a controller in the web application such as:

http://www.example.com/dl.aspx?file=someFileID

dl.aspx would then handle the authentication requirements and redirect to login if needed. If authenticated, it would look up the file, find it on disk, read it in and then return the contents to the visitor after setting the appropriate response headers for mime/type and filename (via Content-Disposition). There are other ways to approach this, but I've generally found this to be the path of least resistance for IIS.

3
  • That sounds like a good idea, and definitely worth pursuing. Following what you're saying, I'd want to only let the VirtDir respond to requests if they came from mywebsite. Correct?
    – Chris L
    Jun 14, 2010 at 20:31
  • If you're imposing some form of authentication in your web application, you would use the same logic within the download controller, in which case it shouldn't matter where they "come from" as long as they have a valid authentication token. Jun 14, 2010 at 21:08
  • Thanks for the help, I think I got enough to come up with a plan.
    – Chris L
    Jun 14, 2010 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .