We have a site that has temporary folder in the site itself. Which is required by 3rd party tools.
https://server/site/tempfiles/. We've denied access to it via web.config file. If someone browses to this folder via URL, access is denied.
This site is protected by Forms Auth. But not all scenarios work as expected.
Scenario 1
The IIS authentication set Anonymous Authentication = Enabled on this tempfiles folder. The folder is not browseable via URL. When temp document (PDF) is created for viewing in the page document viewer, this document is available to direct access via URL. For example https://server/site/tempfiles/mydoc.pdf.
But in this case anyone who has this URL can also access this file
Scenario 2
The IIS authentication set Anonymous Authentication = Disabled on this tempfiles folder. The folder is not browseable via URL. When temp document (PDF) is created for viewing in the page document viewer, this document is not available to access via URL directly. For example https://server/site/tempfiles/mydoc.pdf. The problem however, is that this document is also not available to view when user clicks on a link in the page, which should open this document in the new browser popup window. HTTP 401. (Works with Anonymous Authentication = true)
Ideally, the goal here is to have this document not accessible via direct URL by anyone but the original requestor, person with session. And popup should work.
Thank you