I have a generic handler (ashx) that return a file from the file system. This handler is not behind a login. However, I only need to return the file if the request has been made from inside another .net application via a WebClient object. Essentially the user would type the ashx url in a box and click an upload button which would transfer the file securely.
In the ashx file how do I determine if the request is coming from the "http://myapp.com/Upload.aspx"?
Thank you,
Virgil
In the ashx file how do I determine if the request is coming from the "http://myapp.com/Upload.aspx"?
You absolutely can't do this if your handler doesn't require any authentication. The same way as you can write a WebClient to consume this handler, anyone could. And the handler has strictly no way of knowing where the request comes from (other than the IP address). So unless you make this ASHX handler require authentication your only chance is to restrict the caller by IP address. In the handler you could check whether the Request.UserHostAddress corresponds to the IP address of myapp.com.