Controlling downloads with sessions

[thehms]

hi all...
i have this website that requires a user to login before he can download pdf files....

i have a flag called LoginFlag in the session that is kept with 1 as long as the user is logged in.... how can i use it to limit the download of the file only to registered users??..

i can disable the link, buti want to completely disable it even if the user enters the full URL path to teh file directly....

thanks
The HMS

 

[ArizonaRedneck]

on page load:

If Session("LoginFlag") = False Then
   Response.Redirect("[URL unfurl="true"]http://www.<link[/URL] here>")
End If

-
"Do your duty in all things. You cannot do more, you should never wish to do less." Robert E. Lee

 

[dragonwell]

By using FormsAuthentication, you don't really need a LoginFlag in Session. FormsAuthentication is done using a AuthenticationTicket, which is basically a cookie. This is all independent of the Session mechanism.

So, to hide the link from users who are not logged in (not authenticated), just use:

If User.Identity.IsAuthenticated Then
    downloadLink.Visible = false
Else
    downloadLink.Visible = true

End If

That'll still work if you decide to switch to Windows Authentication or Passport, too, BTW.

i can disable the link, buti want to completely disable it even if the user enters the full URL path to teh file directly....

I don't think you can programmatically restrict access to the files in a folder (other than .aspx pages) without changing the settings in IIS. Maybe instead of storing the files in an easy to guess directory structure, use a download page that requests the files from some hidden place, the way some sites do.

 

[thehms]

thank you guys... it worked...