How do we authorize static file in asp.net mvc?

Sachin Singh

Whenever someone uploads a file it goes to a folder say myfolder and it stores user documents say doc1.doc, now anyone can see it if he knows the path like localhost/myfolder/doc1.doc.

How to apply authorization here.

7 Replies

Know the answer? Post it — somebody with the same question will find it here.

Varun Setia6y ago
Yes, that is Pre-Requisite. We must place files in folder that is not publicallly accessible. It can be ../../myFolder or drive://myFolder
0
Sachin Singh6y ago
The below configuration is working for me ,
step1:- add web.config to the directory.
step2:- add handler for the same.
"1.0"?>



        "?" />




      "PDFHandler" verb="*"
        path="*.pdf"
        type="System.Web.StaticFileHandler"
        resourceType="Unspecified" />
+4
Sachin Singh6y ago
@varun, it is a good solution , but if someone type the Url :- domain/folder/yourdoc.doc or domain/folder/yrimg.png then , he can access it , isn't it?
+2
Varun Setia6y ago
1. [Authorize]
2. public FileResult Doc(string filename)
3. {
4. var filePath = Path.Combine("myFolder", filename);
6. return new FilePathResult(filePath, "application/vnd.openxmlformats-officedocument.wordprocessingml.document");
7. }
+2

Sachin Singh6y ago

Thanks for reply everyone,

I do not have access to IIS @Dhruval,

How to secure a static folder or file in MVC not in core @varun.

Dhruval Dave6y ago

Hi There,

If possible, Take a look at https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization

Do letus know if you need anymore guidelines

Varun Setia6y ago

Hi,

In .NET Core, we can do something like this if we want to use proper authorization,

[Authorize]
public IActionResult Doc(name)
{
var filePath = Path.Combine(
_env.ContentRootPath, "myFolder", name);
return PhysicalFile(filePath, "application/vnd.openxmlformats-officedocument.wordprocessingml.document");
}

Else,

You if you want to view document in wwwroot by anyone use the code below and place file anywhere inside wwwroot,

// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
//...
app.UseStaticFiles();
//..