How do we authorize static file in asp.net mvc?

Question

Whenever someone uploads a file it goes to a folder say myfolder and it stores user documents say doc1.doc, now anyone can see it if he knows the path like localhost/myfolder/doc1.doc. How to apply authorization here.

Sachin Singh · Answer

The below configuration is working for me , step1:- add web.config to the directory. step2:- add handler for the same. "1.0" ?> "?" /> "PDFHandler" verb= "*" path= "*.pdf" type= "System.Web.StaticFileHandler" resourceType= "Unspecified" />

Sachin Singh · Answer

@varun, it is a good solution , but if someone type the Url :- domain/folder/yourdoc.doc or domain/folder/yrimg.png then , he can access it , isn't it?

Varun Setia · Answer

[Authorize] public FileResult Doc( string filename) { var filePath = Path.Combine( "myFolder" , filename); return new FilePathResult(filePath, "application/vnd.openxmlformats-officedocument.wordprocessingml.document" ); }

Sachin Singh · Answer

Thanks for reply everyone, I do not have access to IIS @Dhruval, How to secure a static folder or file in MVC not in core @varun.

Dhruval Dave · Answer

Hi There, If possible, Take a look at https://docs.microsoft.com/en-us/iis/manage/configuring-security/understanding-iis-url-authorization Do letus know if you need anymore guidelines

Varun Setia · Answer

Yes, that is Pre-Requisite. We must place files in folder that is not publicallly accessible. It can be ../../myFolder or drive://myFolder

Varun Setia · Answer

Hi, In .NET Core, we can do something like this if we want to use proper authorization, [Authorize] public IActionResult Doc(name) { var filePath = Path.Combine( _env.ContentRootPath, "myFolder" , name); return PhysicalFile(filePath, "application/vnd.openxmlformats-officedocument.wordprocessingml.document" ); } Else, You if you want to view document in wwwroot by anyone use the code below and place file anywhere inside wwwroot, // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { //... app.UseStaticFiles(); //..