Prevent Direct Access To files ASP Web.Config

NathanMedSchoolsHR 0
Viewed 33

Strange question but hopefully its possible.

we have files in the root of our site (/files) these are uploaded through the main cms side of the website (/admin) and to be accessed by people who have access to the (/school) directory.

At the moment, if you have the direct link URL EDIT TO THE FILE you can gain access to the file

the files folder has its own web.config file with some rules, is there a way i can add some of my own authentication within the web.config to only allow requests that come from the School folder to have access to the files?

In my head i would have a piece of VB code that does something like this:

If (Request.UrlReferrer <> Nothing) Then
            If Page.Request.UrlReferrer.ToString.Contains("/School/") = True Then
                ???
            End If

        Else
            Response.Redirect("index.aspx")
End If

I've tested this in a simple page and it seems to work okay.

asp.net vb.net
1 Answers

Well, I would assume that the users who can use school folder are memembers of a secuirty role called School (or some such).

thus, any user not a member of school can't use the pages (or files) in the school folder.

Since you want the SAME restricitons for the folder files, then use the same web.config to secure the files folder.

That will mean only users who can use the shools folders will also be the same group of people that only use the files folder.

Now the above will not stop members of securty role "school" from typing in any valid URL to the files folder. So, if you want to prevent this, then I would suggest that for all files up-loaded, you create a folder inside of files folder based on their PK row in the membership table (Memebership.ProviderKey).

Then what you would do is turn off all role groups rights to the files folder. I perfer not EVER allowing a direct URL to files.

Remember, only IIS respects the IIS security settings and provider for a web based URL. Code behind is 100% free to load, read, write, use, play with ANY file via code behind. Code behind uses plain jane FULL path names - and those path names and file names used by code behind does NOT care nor use IIS security settings. Only web based URL's dish out by IIS respect and use the IIS security settings you have for the schools folder. So, copy the web.config for schools over to files, and you are done.

But, code behind? it does not care nor use those settings at all.

So, code behind does NOT use nor respect nor care about IIS security settings. IIS role membership ONLY applies to the asp.net pages and web based URL's. But, code behind is a 100% free to get and grab any file on the system - even files outside of the wwwroot path name of the web site.

So, as a 2nd level and better security? I would not allow ANY URL's to the files folder.

You then display a grid or list of files on the web page, and code behind for the download button can then go read/get the file (you can use TransMitFile to download that file)

So, best approach is to not allow ANY valid URL's to the files folder.

However, for now, since you only want people who can use the schools folder also be the SAME people that can use the files folder? Then just use the same web.config for both folders - only those people with role of "school" will thus have use and rights to the files folder.

From the information you provided, then you don't really need any code changes - only to take the security settings from the school folder web.config, and copy that to the files folder, and you should be done.

Now, it is possible that the schools folder is not secured by using IIS security and roles - but then again, that would a epic face plant and horrible design choice.

Albert D. Kallal0
Related