asp.net secure images against static requests from other users?

Question

I work on a site that generates dynamic images for each specific user. Sometimes these images contain depictions of very sensitive data. Lately we have started to see requests for images that belong to a different user in the form of

http://myapp/images/someuid/image1.jpg

obviously, someone figured out they could access another users images if they created the proper URL. we store the images to the file system to help reduce bandwidth.

• how can we protect this - some sort of http handler?

• is there a way of serving the image to take advantage o -f caching without having to write it to the file system and letting IIS do the dirty work?

Answer 1

I think the best option would be to deny direct access to the images from the web and create an aspx that will check users permissions and return the right image.

Answer 2

If the images are to be private to a particular user, then you should either store them outside the main application folder or put a web.config in each of those image folders (like someuid) and limit the access in the configuration file - either cutting out everyone (deny="*") or allowing access just for the particular user (allow="john").

In both cases you can use a handler to stream the image to the user, but at least you can check for permissions now. If the requesting user does not have permissions then throw a 401 at him or even display another image like imagenotfound.gif.

However, I am afraid the handler will generate a lot of traffic as there will be one call per image, I don't know how many images you're displaying per user.

Answer 3

Use an .ashx:-

TimeSpan maxAge = new TimeSpan(0, 15, 0); //!5 minute lifetiem.

context.Response.ContentType = "image/gif";
context.Response.Cache.SetCacheability(HttpCacheability.Private);
context.Response.Cache.SetExpires(DateTime.UtcNow.Add(maxAge));
context.Response.Cache.SetMaxAge(maxAge);
context.Response.Cache.SetLastModified(lastModified); // last modified date time of file
context.Response.WriteFile(filenameofGif);

You can include what ever code checks you need to ensure the correct users is accessing the image.