ASP.NET Forms Authentication via Querystring

Question

Hello StackOverflow brain trust,

I currently have an ASP.NET 3.5 SP1 running on IIS 7. I have enabled forms authentication using .NET Membership and setup some folders that are restricted according to roles I have created. For instance, if an anonymous visitor tries to access the file h t t p://www.mydomain.com/restricted/foo.txt, he/she will be redirected to a login page, as expected. So far so good.

What I would like to do is provide access to protected files by allowing visitors to specify their login credentials in a query string, something alone the lines of:

http://www.mydomain.com/foo.txt?user=username&pass=pwd

Is this possible at all? Any insights are greatly appreciated!

Victor

Answer 1

you should be able to write an http module that intercepts the request and authenticates the user based on the querystring. However, just for the sake of completeness, I'd like to question whether it's a good idea to provide users their username and (in particular) password in plaintext.

Answer 2

You could easily create a download page that would authenticate the user and then forward them to the requested file. Something like navigating to Download.aspx?user=username&pass=pwd&file=foo.txt.

This however is NOT recommended. You should never require users to pass login information via a URL.

Answer 3

A secondary answer based on comments you've made to other questions is that you could simply put your download page in a directory. The subfolder could have a web.config that allows unauthenticated users access to the contents within :-)

something like:

<configuration>
   <system.web>
      <authorization>
         <allow users="*" />
      </authorization>
   </system.web>
</configuration>