Securing Individual Files in ASP.NET

Question

I have a scenario where a user will have access to a one-time-url. When the user clicks on the URL, specific files will be available to that user.

I have many files on the site but would only like certain files to be accessible by that user.

I have though about generating an authenticated cookie and using forms based auth and applying permissions to a certain folder, but I need authorization on indiviual files. and the files will constintly be changing.

What would be the best way to give a user only access to specific files? (I won't display the other files, but I still do not want other files available if they are typed in the URL)

Answer 1

I would provide an abstraction around the actual file retrieval. That way the user never sees file name. Something like www.example.com/File.aspx?id=SOMERANDOMGUID

That RANDOMGUID could reference a file in the back end.

Answer 2

I would create an .ashx (handler file) and have that serve the files to the user (load into memory and then write the contents out by pushing the file to the content stream). That way the end user never has permissions to the actual files on the system but can still access them. Your code can then control when and how long each file is available to a user.

Answer 3

If you have lots of disk space, one way to accomplish this is to copy the files to a randomly-generated folder, so that the URL to a user's files is unique for each user.

Answer 4

I think it would be easier if your files are associated with an ID and the path is kept in the database. This way you can pull the files using the ID.