How do I prevent unauthorized attempts to access a specific file type?

Question

This is really a couple of questions about preventing unauthorized attempts to access a specific file type. Here go the questions:

1. How do I prevent users from directly requesting a type of file? Do I write an HTTP handler?
2. After preventing a direct download, can my app still explicitly serve that file type? How?

Answer 1

The way to do this is to:

1. Put all your tif files in a non publicly accessible location
2. Create an IHttpHandler to serve these tif files based on authentication (or whatever limitation you choose).
3. (Optional) Set up a rewrite rule so that all tif requests go through your IHttpHandler. This creates nice URL's again.