Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Security / August 2003

Tip: Looking for answers? Try searching our database.

Forms Authetication to Protect Single File Using Asp.net

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
rodrigo - 20 Aug 2003 17:03 GMT
I want to protect a single file (openvideo.aspx). I already setup the
folder as an application in IIS.
The authentication seems to work fine and the permissions works as it
should.

The problem comes after the user gets authenticated. I need to store
each user info in database after it gets authenticated at any time,
not only the first time.
I am using persistent cookie.   It seems that register.aspx it's being
bypassed or skipped after authentication and I can't force the
register.aspx (loginUrl) to be checked after authentication.

I tryed using Request.IsAuthenticated but it always returns false.
From my little understanting of .net framework, I thinks something is
happening behind that is taking control of cookie authentication and
using session instead.

<configuration>
<system.web>
 <authentication mode="Forms" >
  <forms loginUrl="register.aspx" name=".AUTH1" protection="None"
path="/" timeout="20" >
  </forms>
 </authentication>
</system.web>

<location path="openvideo.aspx">
 <system.web>
  <authorization>
  <deny users="?" />
  </authorization>
 </system.web>
</location>
</configuration>

thanks

Rod
rodrigo - 21 Aug 2003 18:40 GMT
Let me clarify better my situation.

login page = register.aspx
protected page = openvideo.aspx

SIMULATION
(First time access. No cookies yet)

1. Try to access openvideo.aspx
2. Asp.Net checks web.config permissions
3. It is protected, then redirects to register.aspx
4. User informs name and password and submit back to register.aspx
5. register.aspx validates user in database and redirects to
authorizes openvideo.asp page
6. Cookie is persistent
7. Close the brower and try to access openvideo.aspx
8. Asp.Net checks web.config permissions. It is protected, but this
time do not redirect to register.aspx since it is authenticated.
9. Asp.Net just lets the user see the file content.
10. Clean cookies
11. Things repeat like first step

With this situation I can't force tracking of info at all times even
after authentication.

The point is I need track user info (querystring, time, etc) each time
he access openvideo.aspx because register.aspx does not ge hit after
authentication.

You suggestion to get rid of persistent cookie would make
register.aspx pop up at all times and it would be annoying for the
user. I want it to be authenticated, but always force authentication
to pass by register.aspx.

Some people will say, what's the point if you can track info directly
in the destination or protected file. Well in this case I know I can
track this type of info in openvideo.aspx since it gets hit all the
times, but it does not protect the media files from direct browser
access. If you know the path to the media you can access it easily.

Right now that is not my major concern. Later, I'll need to use a
handler to handle the media by file extension (ex. wmv, mpeg, etc)
without intermediate pages. And if you want to track something at all
events it will have to pass by register.aspx.

Maybe I confused you more, sorry about that and thanks for you
patience.

Rodrigo

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.