Handler for security... Solution could change lives!

[mbiro]

I am trying to figure out how to set up a handler in the web.config file that will, based on a token sent from another server, authenticate the user and allow him to view the pages and access the multimedia files in the site. I want to prevent putting an include file on every page and prevent someone from typing

http://www.mysite.com/movie.mov

and getting to the movie.

I inherited literally thousands of html pages and countless multimedia files that are to be put on a content server. I need to ensure that the only way to get to these pages is if the user comes from my other server.

I started looking into handlers. Am I on the right path. Anyone have a solution or a good place to start? Forms authentication seems to require a login, but I just want to allow someone in if they come from my other server.

 

[BoulderBum]

It may also be easy to implement as a Web Service. The security token could be a parameter required for retrieval.

[COLOR=blue gainsboro]
Get a FREE iPod by helping me get mine! Click my referrer link:

http://www.freeiPods.com/default.aspx?referer=8158886

More about the company and deal:

http://www.wired.com/news/mac/0,2125,64614,00.html?tw=wn_2culthead

[/color]

 

[mbiro]

Would that require code to be added to every static html page? Also, how would I use the webservice to secure the multimedia files? I can't change directory structures as the links to the media are on thousands of html pages.

 

[BoulderBum]

Would that require code to be added to every static html page?"

Not necessarily. If you configure security so that only the identity used by the web service has access, then use the service to serve the page or something, though frankly I'm not sure if it would work, or quite how you'd arrange such a setup if it did. (I know that helps a ton).

As sort of an in-between solution building off of your idea, perhaps you could:

1. use forms authentication on the media server to control access to the files.
2. pass a security token and unique information about the browser or user via a web service such that the server prepares for the visitor by storing some sort of security pass associated with said user.
3. direct the user to the file on the media server, at which time the forms authentication mechanism can use the security pass to authenticate access.

[COLOR=blue gainsboro]
Get a FREE iPod by helping me get mine! Click my referrer link:

http://www.freeiPods.com/default.aspx?referer=8158886

More about the company and deal:

http://www.wired.com/news/mac/0,2125,64614,00.html?tw=wn_2culthead

[/color]