Click here to Skip to main content
15,888,286 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I want to restrict users to access files using URL absolute path (authenticated and not).

Users wont be able to access a CSS or Js file (for example entering http://codeproject.com/css_folder/something.js).

Obviously I cant deny access on web.config because if I do that the JS are not executed (for authenticated users).

So I'm thinking on an approach through some code. Something like this:

C#
string path = Request.Url.AbsoluteUri;
        string strExt = System.IO.Path.GetExtension(path); // to get extension
        Response.Write("here: " + path);
        Response.Write(" test: " + strExt);
        if (!System.IO.Path.IsPathRooted(path)) //should get if entered absolute path
        {
            if ((strExt == ".css") || (strExt == ".js"))
            {
                Response.Redirect("notas.aspx");



But that's not working. And is natural, because when we enter absolute path there's no more server side code processed on that page.

From what I searched the solution is using a HttpHandler to build CSS and JS, and then change authorization on those handlers.

I did on web.config
XML
<httpHandlers>
         <add verb="*" path="css/*.css" type="handler.MyHttpHandler, handler" />
      <add verb="*" path="Script/*.js" type="handler.MyHttpHandler, handler" />
</httpHandlers>

and created a class Myhhtphandler

<pre lang="cs">

public class MyHttpHandler : IHttpHandler, IReadOnlySessionState
{
    public void ProcessRequest(HttpContext context)
    {
       
            context.Response.Redirect("/login.aspx?retUrl=" + context.Request.RawUrl);
           
      
    }
    public bool IsReusable
    {
        get { return false; }
    }
}


I have two problems: I dont know if this correct, and I get an error "could not load file or assembly 'handler' or one of its dependencies. The system cannot find the file specified."

Sorry if the solution is too obvious, but I honestly dont know.

EDIT: I created a web.config dedicated on css folder a placed html handlers, this way I dont get errors but I still can access the css file through URL absolute path.

EDIT2:

Now using as simple as that: MyHttpHandler.cs:

C#
using System.Web;
using System.Web.Security;
using System.Web.UI;
namespace test
{
   public class MyHttpHandler : IHttpHandler
   {
      public void ProcessRequest(HttpContext context)
      {
         context.Response.Redirect(
            "~/Downloads/Files/AccessDenied.aspx");
      }
      public bool IsReusable
      {
         get
         {
            return true;
         }
      }
   }
}


css/web.config:

XML
<?xml version="1.0"?>
<configuration>
  <system.web>

        <httpHandlers>
          <add verb="*" path="*.css"
          type="test.MyHttpHandler"/>
        </httpHandlers>

  </system.web>
</configuration>


Still dont work.
Posted
Updated 27-Dec-10 16:18pm
v4

1 solution

Change the Web.Config to,

XML
<add verb="*" path="css/*.css" type="handler.MyHttpHandler" />


I believe "handler" is your namespace.

IHttpModule is perfect for your scenario because Module is the one which gets execute first before all the request.

Refer here[^]
 
Share this answer
 
v2
Comments
Maxdd 7 27-Dec-10 22:02pm    
Without the "namespace" dont work as well.

How should I use IHttpModule ?
Venkatesh Mookkan 27-Dec-10 22:07pm    
Yes. It will not work without namespace. But the type="handler.MyHttpHandler, handler" the "handler" after comma is assembly name. I hope you know what is assembly name.

IHttpModule is as similar as IHttpHandler which with different function implementation. You have register Modules to your website using web.config like Handlers.

I have added the reference link in the answer section
Maxdd 7 27-Dec-10 22:09pm    
Here it is:
<add verb="supported http verbs" path="path" type="namespace.classname, assemblyname" />

I'll take a look at ihttpmodule.
Maxdd 7 27-Dec-10 22:19pm    
Meanwhile what do you think of my new implementation? (I edited my question). I really believe that shoulded work.
Venkatesh Mookkan 27-Dec-10 22:38pm    
"Still don't work" - means? Are you still having problem in configuring the Handler?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900