web.config in directory with no aspx pages

Question

I have a directory where I am placing PDF files that are generated by my application. The issue is that since there are no aspx pages, the security in the web.config is not preventing direct navigation to those pdf's. Granted, the information is public, I just dont want someone to be able to go straight to them for a variety of reasons.

So the question is, how do I prevent access to that directory in a web.config file? here is what I have:

<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
    <authorization>
        <allow roles="role1" />
        <allow roles="role2" />
        <allow roles="role3" />
        <allow roles="role4" />
        <deny users="*" />
    </authorization>
</system.web>

Answer 1

You should be using an HttpHandler to accomplish file security you can map extensions through IIS and use these to handle mappings of each particular file type (ie: pdf, doc, exe, etc...)

Here is a link describing it...

http://www.15seconds.com/Issue/020417.htm