Best way to perform authentication on every request

Question

Hello.

In my asp.net mvc 2 app, I'm wondering about the best way to implement this:

• For every incoming request I need to perform custom authorization before allowing the file to be served. (This is based on headers and contents of the querystring. If you're familiar with how Amazon S3 does rest authentication - exactly that).

I'd like to do this in the most perfomant way possible, which probably means as light a touch as possible, with IIS doing as much of the actual work as possible.

The service will need to handle GET requests, as well as writing new files coming in via POST/PUT requests.

The requests are for an abitrary file, so it could be:

GET http://storage.foo.com/bla/egg/foo18/something.bin

POST http://storage.foo.com/else.txt

Right now I've half implemented it using an IHttpHandler which handles all routes (with routes.RouteExistingFiles = true), but not sure if that's the best, or if I should be hooking into the lifecycle somewhere else?

I'm also interested in supporting partial downloads with the Range header. Using

response.TransmitFile(finalPath);

as I am now means I'll have to do that manually, which seems a bit lowlevel?

Many thanks for any pointers.

(IIS7)

Answer 1

I think having a custom handler in the middle that takes care of this is exactly how you should be doing it.

Answer 2

TransmitFile is the lightest-weight programmatic way to serve a file that I am aware of.

However, you might not need to write your own HttpHandler. You can use the MVC handler and just dedicate a controller action to the job. Something like:

http://storage.foo.com/Files/Download/SomeFileIdentifier

...routing to...

public FilesController
{
   public ActionResult Download(string id)
   {
      //...some logic to authenticate and to get the local file path

      return File(theLocalFilePath, mimeType);
   }
}

The File() method of controller uses TransmitFile in the background, I believe.

(PS, If you want shorter URLs, do it via custom routes in global.asax.)