About security,

A Long Time Ago... in the ASP days we developed a document managment system, and we had the same questions about how to eliminate the case that someone knowing the exact location of the document could download it.

We ended with this solution:

1. Files are stored in a non web access folder.
2. When the user ask for links for download it is presented with fake urls (with some document identification data appended in the url).
3. When the user tries to click in the link the server would return a 404 error. And here comes the trick, we implemented and asp page and configure the 404 error to redirect the request to this page.
4. In this page was all the code required for user authentication and permission check, if the document exists and the user has download permission, the document is send (with fake origin info). Otherwise the normal 404 error page is shown.

With the actual ASP.NET technology we should be able to implement something similar using httpmodules.

---

Patrizio Palazzetti

Not sure how far you are down the development route for this module...

On the subject of using a 404 page solution, my gut feel is that this may work but it is not an elegant solution.

I have worked on a number of systems that deliver documents to users of an ASP.Net page. These documents are dynamically created by external systems, so there is no physical location to direct the user to.

This is resolved by using the code below, which basically returns binary data to the web page, which in this case will display a PDF, however it can be setup to return any binary datatype, or known file types.

Response.AddHeader("Content-disposition", "attachment;filename=Output.pdf")Response.ContentType = "application/pdf"
Response.BinaryWrite(oStream.ToArray())
Response.End()

The only down side to this implementation is that the requested document would have to be loaded into memory before being returned to the client. This could have an impact on memory if the file size is large.

Something else to consider is how do other sites do it? For example if I buy some software from a site, I’m sure they don’t just redirect to a physical location on the server where the download file lives.

Haven't been able to find this anywhere, but how about the ability to upload more then one file at a time, meaning you can select 1, 2 or more files and upload them to the server.  After which, you can modify the properties...