.net and access security 2

[cjburkha]

Hi,

I have a simple web page, and it uses a MS Access database for the backend. My question is, how can I keep users from downloading the DB? They need read/write access to get at the data, but how I can keep them from DL it by typing,

http://www.mydomain.com/db/sample.mdb

in their browser?

I am running SBS 2003 wich includes IIS 6.

Thanks for the help, if this is the wrong forum, please let me know.

CJB

 

[flugh]

Can't you put the .mdb file outside of the docroot? That way there's no mappable link to the file itself. Your server-side code can access files outside the docroot as long as the owner of the IIS process has read permission on the non-docroot directory and the .mdb file.

I could be way off, as I've never used IIS or tried backending a site with an Access .mdb

----
JBR

 

[cjburkha]

Thanks for the idea, I can do it now since I am hosting the site fore development, I'll just have to find a host that will give me access outside the root dir.

Thanks again,

CJB

 

[chiph]

Or you can put it in a subdirectory with a .htaccess file protecting it (turn off directory browsing, too).

Chip H.


____________________________________________________________________
If you want to get the best response to a question, please read FAQ222-2244 first

 

[cjburkha]

chip, I don't know about .htaccess files, I'll check out that solution too, thanks.

 

[cjburkha]

Thanks guys for your help. I can't use .htaccess because I've found no way that IIS will support it, and my web host is almost guranteed to NOT give me access outside of webroot. (You guys ever hear of metavante? They are a secure hosting company, and they have pretty strict security guidlines.)

I poked around a bit more and will probably just rename my mdb to .aspx, and it will be much harder to download.

CJB