Question

URL authorization only applies to Asp.Net related file types?1 But why couldn’t it also be applied to non-Asp.Net file types?

Thanx

Answer 1

This is because of the script maps for ASP.NET. Only certain extensions are mapped into ASP.NET. The rest are handled directly by IIS. This is by design, for performance reasons.

There are two ways to handle this.

1. Duplicate your authorization rules in the web.config files in NTFS File ACLs (that is, set permissions on folders and files directly). Make sure that the user’s authentication scheme matches the accounts and groups used for controlling access… in other words, if you’re using SQL to store username tokens, this won’t work, because those tokens won’t necessarily map back to domain users and groups/roles.

2. Create an IHttpHandler to serve up your non-ASP.NET files. From the ProcessRequest method, call the Server.MapPath(url) method on the incoming URL, then stream out the file using Response.WriteFile(filename). You will probably need to set the ContentType property first. And, (here’s the bad news), you may still need to perform a declarative or imperative access check — just having the entries in the web.config files may not work. See Custom ASP.NET Processing with HTTP for more information on writing your own handler. It’s probably a good idea to make separate handlers for each content type. Once you’ve written one, you’ll see how easy they are to make.

You could try (haven’t tried this myself) to add <httpHandlers> elements to web.config files where you have additional <authorization> elements — use the <remove> element to remove the inherited HttpHandler and add another one at the subfolder level (perhaps pointing back to the same class?). I’m not sure this will work, but it’s worth a try.

Finally, if you really don’t want to go through and do all this work, you could simply add more extension mappings in IIS. For example, take a look at How to: Register HTTP Handlers, you can add a mapping for .jpg files to the aspnet_isapi.dll (take a look at the existing mappings for .aspx and so on). You do not need to add an HttpHandler element to your web.config, because the machine level web.config already contains this entry:

<add path="*" verb="GET,HEAD,POST" type="System.Web.DefaultHttpHandler" validate="true"/>

Please note that this may have very serious performance issues on your site.