How Do I Tell ASP.NET Forms Authentication to Not Authenticate Certain File Extensions ?

Question

I have an asp.net 2.0 (.net3.5) website on II6. It is setup to use forms authentication. I have set up "aspnet_isapi.dll" as an entry in the "Wildcard application map" in IIS so all requests would go through asp.net. In web.config I have disallow all anonymous user via the following setting:

<system.web>
    <authorization>
        <deny users="?"/>
    </authorization>
    ...
</system.web>

I would like to make it so that files with certain extensions (specifically image file such as .gif, .jpg) does not need to be authenticated. These files are located in different folders so just permissioning an image folder would not work.

I have modified my own Forms Authentication HttpModule to ignore all such request and just return. But because it ignores these files and not create a Principal, the request remains anonymous and gets an authentication error.

Ideally, it would be great if I can do any one of the following, but it doesnt look like it something that can be done:

1) Allow us to exclude certain file extensions when we setup wildcard mapping in IIS.

2) In my own Forms Authentication HttpModule, I can somehow tell asp.net to stop the asp.net processing pipleline for this file, or to just stop the authentication for it.

3) Allow us to use wildcards in the path attribute of the location tag in web.config, such as:

<location path="*.jpg>
    <authorization>
        <allow users="?"/>
    </authorization`>
</system.web`>

The only solution I can think of is to remove wildcard mapping in IIS and add the Application Extension Mapping individually, so not all requests would be handle by asp.net. But then, I run the risk of missing certain file types, not to mention it would be tedious to add it individually for all known filetypes (minus the image files)

Any ideas ?

Answer 1

Maybe you can try to use httpHandlers section to name the extensions to exclude

<system.web>
    <httpHandlers>
        <add verb="*" path="*.mdb" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.csv" type="System.Web.HttpForbiddenHandler" />
        <add verb="*" path="*.private" type="System.Web.HttpForbiddenHandler" />
    </httpHandlers> 
</system.web>

and then create your own httpHandler to process files requested by user.

You can read more here - http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q307985#2a

it's just my thoughts on your issue.

Thanks, Arty