Static files and authentication in ASP.net

Question

Hi!

Say I have a virtual folder /topFolder/ in IIS7, and in that folder there can be any file that can be displayed in a browser (xml, html, swf, doc etc - typically "unmanaged" resources from the IIS perspective). Before giving the request permission to open any file below the folder, I need to check some session variables in order to see if the user has a "license" for the subfolder and file in question.

I've tried implementing a module with IHttpModule and IReadOnlySessionState interfaces, but the Session is always null on the AcquireRequestState event when the file is "static" and not IIS managed (like aspx, ashx etc).

If I use a custom HttpHandler, I get the session, but then I also need to implement how the content is sent to response. Edit: Since the user isn't downloading the file, I just want IIS to serve the file like it does with its StaticFileModule. The Handler/Module should really be a StaticFileModuleWithAuthorizationHook...

So I really want to do the following: 1. For request /topFolder/* : check session and licenses etc a) If ok, continue serving file b) If not ok, interrupt request, or just send FORBIDDEN in response.

Hope someone can help.

Answer 1

You should be able to handle this via the httphandler, the simple way is to use the built in methods to send the file down to the user if they have access.

This article (at the bottom) shows an example of how to do this.

Answer 2

Actually it seems to be doable by doing what this guy says Now I can get the session although it's not a managed resource.