Question

I have a website hosted in IIS with directory browsing disabled. The website is developed in ASP.Net, MySql and C#.
For e.g., If i type http://www.mysite.com/LoremIpsums/ then it shows 403 error. However if i type, http://www.mysite.com/LoremIpsums/IpsumLorem.pdf it shows/downloads the the PDF file. How to disable this?
I have searched on net and found sth like

    <authorization>
    <remove users="*" roles="" verbs="" />
    <add accessType="Allow" roles="Administrators" />
    </authorization>

If i use this in web.config, the user won’t be able to download the pdf file even after logging in. So how to achieve file access only for logged in users. (Either using C# code or IIS Settings)?

Answer 1

Here you Go:

<location path="download">
    <system.web>
        <authorization>
        <!-- Order and case are important below -->
            <allow roles="user"/>
            <deny users="?"/>
        </authorization>
    </system.web>
</location>

download is your folder where you want to restrict the anonymous user from direct access.