Asp.net mvc restrict specific users to access folder content

Question

I am trying to restrict users(except admin) to access my folder images. For example the path is:

~/content/images/coverBeg.jpg

If the user navigates to domain/content/images/coverBeg.jpg, he can see the file. I've tryied different sort of things but none of them worked for me. In web config file i've added :

    <location path="~/content/images">
    <system.web>
      <authorization>
        <allow roles="Admin"/>
        <deny users ="*" />
      </authorization>
    </system.web>
  </location>

With no success. After that i've added a web config file to images folder and add those lines of code :

<?xml version="1.0"?>
<configuration>

    <system.web>
      <authorization>
        <allow roles="Admin"/>
        <deny users ="*" />
      </authorization>
    </system.web>

</configuration>

Neither this worked for me. Still everyone can access coverBeg.jpg file

berliner · Accepted Answer · 2016-02-13 16:48:09Z

3

It's because static content, like images, are served directly by IIS, not involving MVC pipeline. To change that, you can do the following:

add

<modules runAllManagedModulesForAllRequests="true">

to <system.webServer> section of site's web.config. It will run MVC pipeline for every request, including static files - like css, js and images.

Then your config from above will work (I mean your 2nd approach).

answered Feb 13, 2016 at 16:48

berliner

1,9753 gold badges17 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ucnobi ucnobi Over a year ago

Does it safe approach? There are files where users should pay to access, is it safe?

berliner Over a year ago

@ucnobiucnobi as safe as all the rest authentication/authorization mechanism. Basically, what it does - it says IIS to send there requests to MVC, and then standard MVC approach work.

Collectives™ on Stack Overflow

Asp.net mvc restrict specific users to access folder content

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related