Activate form authentication for CSV files in IIS7

Question

I have a website on IIS 7. This website has a HttpModule with an AuthorizeRequest event handler. This event does not fire for CSV files and I can access the file without logging in, I guess this is because IIS7 is not configured to require form autentication for CSV files.

How can I set this?

Answer 1

This will impact all files, but you can add a mapping to your server configuration:

1. Go to the properties of your website and click on "Handler Mappings".
2. In the upper right corner click, "Add Module Mapping".
3. Put "*.csv" in the Request Path.
4. Select "IsapiModule" for module.
5. Find the aspnet_isapi.dll in the framework folder of the appropriate .net framework you are using under Executable.
6. Give it a name.
7. Check the tabs in "Request Restrictions" for more options.

This should force any .csv request to parse through asp.net (thus invoking formsauthentication) before servicing the request.

EDIT: Alternatively you can add a wildcard script mapping as desribed here: http://learn.iis.net/page.aspx/508/wildcard-script-mapping-and-iis-7-integrated-pipeline/

This will force authentication to all non-.net files (pdfs, docs, anything).

Answer 2

Hi, this answer explains how to achive what I was looking for. I inserted in web.config the lines in chapter 3 and 4 of the referenced guide, and changed ".htm" with ".csv", maybe someone can optimize the solution for *.csv files. but for me it does what I needed.