Secure static html files using IIS7 in integrated mode and using custom httphandler

Question

My asp.net application is not using formsauthentication. Instead we make a call to database, check username//password and save the value in session if user is logged in.

Now i need to secure my html files. I put IIS7 in integrated mode and added a handler mapping to a statichtmlhandler that i wrote that basically checks that if the request url contains .html and session("userloggedin") is not null then do nothing else redirect to login page.

This works fine. Only problem is my html files show up as blank. How to fix it?

Answer 1

Are you actually including the code to write the HTML file in your handler?

A handler is the end point for a request - a request stops there. If your handler does nothing but a redirect then it's working as you coded it. You must add the code to read the HTML file and serve it.

In my opinion you would be better off doing it higher up the pipeline in an HTTP Module. Modules run in the pipeline, before the request is sent to the handler.

And even nicer option would be to use forms authentication, as you can use IIS7 URL authorization to protect HTML, JPG, any file at all.