Obscuring a links url

Question

Hi, Please pardon my ignorance. I'm looking for a point in the right direction.

I have a page with some (pdf)download links. If I click the link a pdf will open in a new page. I can see the folder the pdf resides on the server. If I guess at other filenames in the same folder, maybe I can get lucky. Some of the files are private so I don't want the user to get a hint from the url. How can I obscure this infomation? We are running .net 2 on the backend. Could I call a method and get the file to open?

Any help appreciated. I'm not sure what to search on to get me started.

Thanks

We have a .Net 2 backend.

Answer 1

You could associate each PDF file with a guid in your database, then you could create one page, DownloadPdf.aspx, and pass it the guid to locate the right file on your filesystem, and render it:

Response.Clear();
Response.ContentType = "application/pdf";
Response.WriteFile(physicalPathToFile);
Response.End();

EDIT

If you want to give the user the ability to download the pdf, you could add the following line, before Response.End:

Response.AddHeader("content-disposition", "attachment; filename=" + filename);

Where filename could be the non-obscure name of the physical file (or any name you want to give it).

Answer 2

D.'s post is 100% correct, you can go one step further and save the file with a .resources extension therefore IIS would never directly serve the filE.