3

I have a site developed in ASP.NET which is hosted.Now in my site there is folder known as "upload" in which some .rar files are saved for private use.When I directly type the url, the file gets downloaded. Say suppose the file is at "http://www.mathew.com/uploads/mine.rar",if i type the url in the browser and hit enter,it downloads the file even though directory listing is not there.

I want to restrict this..How can I achieve it. Thanks, Mathew

3
  • Are you using membership and role providers? Aug 14, 2012 at 12:23
  • no i am not using such things..its a simple site. Aug 14, 2012 at 12:26
  • Authorization can be used in any asp.net site. You don't have to use membership or roles provider for that. Aug 14, 2012 at 12:40

1 Answer 1

6

You can restrict that by authorization. Put a web.config file in this folder with:

<configuration>
    <system.web>
        <authorization>
            <deny users="*"/>
        </authorization>
    </system.web>
</configuration>

EDIT :

This won't work since rar files are not handled by asp.net, so in addition you need to add a handler for asp.net treat rar files like aspx files:

For classic mode:

<system.web>
  <httpHandlers>
    <add verb="*" path="*.rar" type="System.Web.UI.PageHandlerFactory" />
  </httpHandlers>
</system.web>

For integrated mode (default for iis 7.5 and VS 2012)

<system.webServer>
  <handlers>
    <add name="rar" path="*.rar" verb="*" type="System.Web.UI.PageHandlerFactory"/>
  </handlers>
</system.webServer>
1
  • You're right. rar files are not handled by default by asp.net. Edited my answer to fix that. Aug 14, 2012 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.