I retired from personal blogging in July 2008.
But you can find me over at http://blog.xero.com.

ASP security on file downloads
Posted by rod@drury.net.nz in Old-blog-archives at 8:20 pm on Tuesday, 31 May 2005

ASP.Net security only works on files that pass through the ASP framework.  Links to documents do not - exposing a security hole if you want to keep those documents available only to authenticated users.

Here’s some simple code to stream back a file from a secure directory via aspx.

Private Sub Page_Load …
   Dim sFileName, sFilePath As String
   Try
      …
      Response.AddHeader(”Content-Disposition”, “filename=” + sFileName)
      Response.WriteFile(sFilePath)
   Catch ex As Exception
      Response.Write(ex.Message)
   End Try
End Sub

The AddHeader function ensures the correct file name appears in the download.

Trackback uri |