File Security and Aspx pages Httphandler

[lindaj52]

I have this scenario :-
userid 66 has folder/66
userid 75 has a folder/75
do not want 66 to be able to access 75's files by changeing url.

After logging in, the user has an aspx page has a list of hyperlinks to different files Example(

http://comm/66/test.doc)

I do not want them to be able to change the url to

http://comm/75/test.doc

which would be for another user.
aspx pages are protected but doc,pdf,txt files are not.
I created a custom httphandler but keep getting an "Unrecognized configuration section 'HttpHandlers'" Error with it.

I Would ask for any suggestions as to how to secure these files.I will paste my code if anyone is willing to help me.

 

[link9]

Yes, please. Let's have a look.

-paul

The answer to getting answered -- faq855-2992

 

[lindaj52]

Here is the code for my httphandler

Imports System.Web
Imports System.Web.Security.FormsAuthentication

Namespace ASPXHandler
Public Class MyASPXHandler

Implements IHttpHandler

' Override the ProcessRequest method.
Public Sub ProcessRequest(ByVal context As HttpContext) _
Implements IHttpHandler.ProcessRequest


Dim Filename As String = context.Server.MapPath(context.Request.PhysicalPath)
Dim user
If context.User.Identity.IsAuthenticated Then
context.Response.Buffer = True
context.Response.Clear()
context.Response.WriteFile(Filename)
Else
context.Response.Write("Access Denied.")
End If
End Sub

' Override the IsReusable property.
Public ReadOnly Property IsReusable() As Boolean _
Implements IHttpHandler.IsReusable

Get
Return True
End Get
End Property
End Class
End Namespace

This is my code in my WebConfig

<authentication mode="Forms" >
<forms loginUrl="Login.aspx" />
</authentication>
<authorization>
<deny users="?" />
</authorization>

<httpHandlers>
<add verb="*" path="*.txt" type="ASPXHandler.MyASPXHandler, MyClassLibrary"/>
</httpHandlers>

 

[dace]

This error is often caused by having the httphandlers section in the wrong place in web.config - make sure it's within the system.web section and not enclosed by any other tags (other than the parent configuration section).

After having these types of problems I now always put it at the bottom, right before "</system.web>".