How to secure pdf content on a server in .net 1.1 IIS5.1

Question

I need to block anonymous access of PDF, PPT, DOC, contents on a server through an application built in .Net 1.1; IIS 5.1. I have tried unchecking anonymous access in IIS, but it is not working.

Answer 1

I know this is an old post, and hopefully you're off of .Net 1.1 and/or found an appropriate solution. But hopefully this will help you or someone else. My idea is to move the PDFs outside of your web folder, and change the links to a download handler. In the handler, you could check that your visitor is logged in and allow or disallow access to the PDF. A simplified example would be:

Link: http://mysite/download.ashx?path=secure_folder/my.pdf

The handler might contain:

Public Class Download : Implements IHttpHandler
    Implements SessionState.IRequiresSessionState

    Public Sub ProcessRequest(ByVal context As HttpContext) Implements    IHttpHandler.ProcessRequest
        If User.IsLoggedIn() Then 
            'implement your own user validation here

            Dim path as String = "E:\" & Request.QueryString(path).Replace("/", "\")

            Using fs As IO.FileStream = New IO.FileStream(path, IO.FileMode.Open, IO.FileAccess.Read, IO.FileShare.Read)

                Dim fileLen As Long = fs.Length()
                Dim fileData(fileLen) As Byte
                fs.Read(fileData, 0, Integer.Parse(fileLen.ToString()))
                context.Response.ContentType("application/pdf") 'set as appropriate based on file extension
                context.Response.BinaryWrite(fileData)
            End Using
        Else
            context.Response.Write("You don't have access to this resource.")
        End If
    End Sub

    Public ReadOnly Property IsReusable() As Boolean Implements IHttpHandler.IsReusable
        Get
                Return False
        End Get
    End Property

End Class