Question

I want to protect the files in a specific directory so that people cannot link to them – but I still need my program to be capable of rendering them, so password protecting the actual folder won’t work. Is there any way to facilitate this in ASP.NET MVC? Obviously it’s more about ASP.NET, not MVC – but I can’t make use of things like Session State and Postback and such…

Answer 1

You could put that directory outside of the web app’s root directory (so that it can’t be accessed using some copied URL) or into a directory where you deny any read access using a web.config file.

Then access the files through an action which requires the current user to be authorized, e.g:

public class FileController : Controller
{
  [Authorize]
  public ActionResult Get(string file)
  {
    return new File(Path.Combine(_rootPath, file);
  }
}

Then you can access the files through an action URL, e.g. http://server/app/File/Get/test.txt.