how to prevent access to virtual directory without login to a website

Question

I have a directory contains some documents, i would like to allow access to files on this directory only if the user successfully logged in to a website. the login users and passwords managed by aspNet Membership tables and stored at the DB.

if the directory was sitting on the website is would be easy since it restricted by default but physical path of the directory is not inside the website and i prefer to leave it that way, since this directory can be access from another website

how to solve this? thanks

Answer 1

You should add the runAllManagedModulesForAllRequests attribute to the modules tag in your web.config like so:

<system.webServer>
<modules runAllManagedModulesForAllRequests="true">
...
</modules>
...
</system.webServer>

This will impose your dotnet security on all files like word documents and such. Then you can secure the folder using the location section in web.config like so:

<location path="SomeVirtualDirectory">
    <system.web>
        <authorization>
            <allow roles="admin" />
            <deny users="*" />
        </authorization>
    </system.web>
</location>