Question

Does anyone know a good practice of securing media for asp.net?

I need to host a variety of media that require permission to a view a specific image/video. i.e. a specific user may or may not have permission to view a media file – and this fact may be changed on the fly.

I don’t care if they can download a media file that they have access to, I just don’t want them to even be aware of items they should not have access to.

I’ve already considered url obfuscation – this seems quite lame to me.

I have form authenticated users (and I’m not willing to change this).

I would like to keep the media file folder structure unrelated to permissions.

Answer 1

Build an HttpHandler that all media must be accessed through. Then, prior to retrieving the file and sending it down to the user, you can perform any validations that you’d like. Keep all of your media outside of the main wwwroot path, or deny access to that folder using permissions.

More info on this topic here:

http://www.15seconds.com/Issue/020417.htm