Password protect files on IIS without using NTFS file permission

Question

We host online reports that a client will log into and view. The reports are ASP pages pulling the necessary numbers from a SQL Server database. The client's access details are managed by a table in the SQL Server too.

In the past we've had one or more PDF or other files that the client might also want to access from the online report. These were simply uploaded into a subfolder within the ASP files folder and linked to from the relevant ASP page.

If I wanted to protect those files to make sure that the user attempting to access them has logged in - is there a way to do this? I'm thinking that the file has to be stored in the database. How do others manage this?

Answer 1

Putting the PDFs in the db is unnecessary. Instead, store the PDFs in a location outside of the web folder. Well away from public access. Create records in a DB for the locations of each PDF with an id number. Assuming you already have an authentication system for users in place, create another table which links the userid to the recordid of the pdf they have access to. From there it's a simple matter of creating a page which checks credentials against this access table, opening the file location provided by the db and response binarywriting it's contents. You can find several examples of doing this scattered about the web. However, ASP classic has this annoying habit of storing the entire file in ram while transferring it which EATS up resources like you wouldn't believe. I'd recommend using an ASP.Net script if at all possible. The code is much easier too

Server.TransferFile()