0

I'm saving User's images (let's say Avatar) from input form to e.g

C:\server_folder\

with random name e.g xcvdfgdfg.jpeg and store path to it in db.

While loading User's profile e.g First name, second name... I'd want to include that image.

Seems like easy task - I'm just gonna use

_ < img src="@Model.AvatarPath">

But it doesn't work - Image is not being rendered but I can access it when I enter that url manually, meanwhile when I save that image in folder

wwwroot/images

then it works properly with path:

_< img src="~/images/xcvdfgdfg.jpeg" alt="Smiley face"/>

So, basically I'd want to relocate folder

wwwroot/images

to

C:\server_folder

Additionally how can I prevent people from accessing those files if they know url?

12
  • You are storing Users Avatar on His own local machine. How will you control him from deleting the file? You should upload the image file to Server and store at server side. In DB (as Base64 string) or Server web directory (static folders). Your Path should reflect the URL to ths image file on server. Oct 18, 2018 at 9:06
  • @PrateekShrivastava I'd want to save it on Application's machine on disk C:\
    – Joelty
    Oct 18, 2018 at 9:07
  • @Amadan So, how can I add location C:\userfiles to my application - as something like wwwroot/images?
    – Joelty
    Oct 18, 2018 at 9:09
  • Web Browsers cannot access Files from System Disks - no matter they know the exact path. This is a Security feature and you can't do so. Imagine a hacker scripts to delete stuff from C:\Windows\ folder. Or Copies malwares to your system. Browser prevent access to File System (unless its a File Browser/Save File Dialog) Oct 18, 2018 at 9:09
  • @PrateekShrivastava I expressed myself wrong. C:\usersFiles is server's location, not user's. Let's rename it to something more obvious C:\server_folder. I want to store images as a files on server and then return them just like .css .js .bmp files
    – Joelty
    Oct 18, 2018 at 9:12

3 Answers 3

0

Use this to configure/setup Static Content Directory in IIS

IIS7, web.config to allow only static file handler in directory /uploads of website

2
  • I'm not using IIS, so I gotta check how to do that on Kestrel
    – Joelty
    Oct 18, 2018 at 9:18
  • 1
    For Kestrel - it should be a method call that you can use during Bootstrap/Startup. May be: app.UseStaticFiles(); or .UseWebRoot("C:\\wwwroot") See this: stackoverflow.com/questions/46161382/… Oct 18, 2018 at 9:23
0

As Prateek mentions I'd use the UseStaticFiles extension method. You can put it in the Configure method of your Startup.cs. You can use multiple of those as long as there are no conflicting RequestPath properties

app.UseStaticFiles(); // For the wwwroot folder

app.UseStaticFiles(new StaticFileOptions
{
    FileProvider = new PhysicalFileProvider("C:\server_folder")),
    RequestPath = "/images"
});

Taken from (adapted): Microsoft Docs

2
  • But what about validation whether user has rights to those files?
    – Joelty
    Oct 22, 2018 at 11:09
  • You could put your own middleware in the pipeline before the UseStaticFiles which does the validation. Or you make a separate controller and return the image (read from disk). With the controller you could use the [Authorize] attribute. Anyways more here
    – hyvte
    Oct 23, 2018 at 12:43
-1

Here's how I solved that:

I'm returning Model which's one of properties is Base64 string.

public class UserProfile
{
    (...)
    public string ImageBase64 { get; set; }
}

I'm converting File to Base64 with this method:

private string ToBase64(string path)
{
    if (System.IO.File.Exists(path))
    {
        Byte[] bytes = System.IO.File.ReadAllBytes(path);
        return Convert.ToBase64String(bytes);
    }
    return "";
}

and then in HTML

< img src="data:image/png;base64, @item.Base64" alt="test />

3
  • Another approach to consider (to get better caching options etc) would be to add an endpoint to your website. For example GetMyImage. Then use < img src="http://yourwebsite.com/getmyimage" alt="test /> GetMyImage will do something similar to stackoverflow.com/questions/40794275/…. This means, for example, if you need the image in your page twice you don't need to include the (large!) base64 version of it twice in the page.
    – mjwills
    Oct 18, 2018 at 10:43
  • nothing here stop unauthorized user from accessing the images
    – Jack M
    Oct 19, 2018 at 7:03
  • @JackM I'm planning to add validation to controller that returns those base64, so I think it'll be safe because User cannot just escape out of application folder and freely check my disks files. e.g: localhost:12345/../../../secret_folder
    – Joelty
    Oct 22, 2018 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.