restricted access to files via ASP

without using system accounts

[randallxski]

I have a site with restricted access where people can download documents in pdf format. All documents reside in a folder. My problem is that if the person puts the full path to the document in the browser (ex. www.mysite.com/documents/documentx), he can download the document without being logged in. What is the best way to create a protected folder that I can access via ASP (with a password) to get the document to the user? Is there any way to do it without saving files to a database or having to use windows basic authentication?

[dotme]

If you have full access to your host server, you could maybe use ASP to create a temporary file, and rename your document folder if you feel its location has already leaked out.

Example - authenticate your user, take them to a page listing your documents using the filesystemobject. When they select one, use fso again to copy the document from its home directory to a "temp" download directory, renaming it to the userid of the logged in user, and then response.redirect to it.

That way, each logged in user might have one stale file in that temp directory, but it prevents buildup over time and allows you to give access to it only through asp authentication.

Just one suggestion - feel free to shoot holes in it :-)

[raywood]

I've done this by using ssl and putting a password in the query string. The protected page checks the password against the list of approved users and redirects to the login page if the password is wrong or missing. So a typed-in url presents a login page or an error mesage if the user typed http instead of https.

I put the code for the password check and redirect in a separate text file so I could include it on all pages that I wanted to protect.

[randallxski]

Thanks for the suggestions. Any chance you have or can point me towards any sample code that does something similar?

[plumsauce]

the problem with the outlined scheme is that once the full url is known it is open to being used without going through the referring page.

search for coldlink

[raywood]

plumsauce, do you mean the scheme that I outlined about checking password and re-directing? I've tested it every way I know how, and it protects my pages. If there is a hole in my scheme, please let me know what it is.

[raywood]

Well, I figured it out, plumsauce. randallxski wants to protect PDF files. My idea only works for protecting asp pages.

[randallxski]

Thanks for the ideas.

I'm considering a solution using ASP.NET with protection in the web.config. I'm not sure if it will work or not. The web site is currently ASP classic and will require an overhaul to upgrade. Are there any .NET gurus that have successfully implemented something similar?

[MozMan]

There's a simple way you can handle this using an ASP page that will hide the actual path of the PDF file. Try this out:

1- Leave your PDFs in the folder where you want them
2- Create an ASP page, called something like RetrieveDocument.asp and append the file name only as your querystring parameter, so they have something like this: RetrieveDocument.asp?strFileName=MyFile.pdf to call.
3- In the ASP page you just created, first verify login credentials. If login verification fails, kick them out.
4- If login verification passes, then user a Server.Transfer to deliver the proper path of the PDF, using the querystring value. The user will never see the path directly to the PDF, and if they save the path to the ASP page, it won't work unless they are already logged in.

Note: your server.transfer command might look something like this:

Server.Transfer "/documents/" & Request.Querystring("strFileName")

HTH

-Moz

[coco86]

This sounds like an excellent solution but when I try it, I get the error message:

Active Server Pages, ASP 0116 (0x80004005)
The Script block lacks the close of script tag (%>)

Is there something else that needs to be done?

[mattur]

Using server.transfer means the server tries to parse and execute the target file as an ASP file - which is a problem if your target file is a PDF with <% in it.

An alternative with classic ASP is to use a ADO stream:

<%
Response.ContentType = "application/pdf"
Set objStream = Server.CreateObject("ADODB.Stream")
objStream.Type = 1
objStream.Open
objStream.LoadFromFile *filepath* 'outside web root
Response.BinaryWrite objStream.Read
objStream.Close
Set objStream = Nothing
%>

[mattglet]

Isn't there a problem with Streams and XP SP2?

[mattur]

Yes, but this is invoking the adodb.stream on the server, not getting the client to invoke a local adodb.stream object. I tested it (v.briefly...) on IE6 + xpsp2.

However, firefox chokes on the file. Adding the following below the Response.ContentType seems to fix it.

Response.AddHeader "Content-Disposition", "attachment; filename=""my.pdf"""

I'd do some thorough testing before going live... :)

[MozMan]

Found another simple solution without the Server.Transfer (I didn't know the server would try to parse the PDF as ASP):

in place of server transfer, put a simple frameset with your passed filename as the frame source. Something like this:

<frameset border=0 framespacing=0 frameborder=0 rows="*">
<frame src="/documentPathName/<%=Request.Querystring("filename")%>">
</frameset>

This way, the user can't see the path to the document, and you don't have to worry about the server parsing teh PDF file.

-Moz

[coco86]

This way, the user can't see the path to the document

unless they view the source...

[MozMan]

unless they view the source...

Excellent point. Obviously, I did not consider that...

-Moz