Securing PDFs, DOCs, in Forms Authentication

Please note this article refers to ASP.NET v 1.x versions.  In ASP.NET 2.0, this is taken care automatically.

When using Forms Authentication, any anonymous request for secured pages will be redirected to Login page.

However, when the request is for static file types like Word, PDF etc., the redirection won't happen and the content will be served.

There are many instances when we want to secure our DOCs, PDFs to only authenticated users.

The problem is that, these static files are handled by the IIS and since we set anonymous authentication in IIS, they won't prompt for username and password.

To handle this, we need to force asp.net to handle these file types.

This can be achieved by the following steps.

1. Open the IIS Control Panel (inetmgr from command prompt)
2. Expand the appropriate nodes and select the Virtual Directory of the application which needs authentication.
3. Right click on the Virtual Directory and select Properties.
4. Click the Configuration Tab
5. A dialog box appears with the list of file extensions.
6. Click Add and a dialog appears asking for URL with browse button and a textbox where the extension type to be entered.
7. Click on the Browse button and select the the following path
%windir%\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll
8. Enter the extension type in the textbox such as .pdf, .doc etc.,
9. Select the "Limit to" radio button and Put the same properties as like for aspx files i.e. GET, HEAD, POST, DEBUG
10. Click ok - ok. Repeat the same for other file extension types which you want to secure.

Now the above extensions will be served by asp.net and hence they will be authenticated, provided you are securing the folder, directory which contains these files to be secured.

Hope it helps.

Print | posted on Monday, April 25, 2005 7:35 AM

Comments on this post

# re: Securing PDFs, DOCs, in Forms Authentication

Requesting Gravatar...
When I do the above and then authenticate it will not display the pdf...is there something I am missing to have it go ahead and use the pdf viewer?
Left by David on May 14, 2008 4:40 PM

# re: Securing PDFs, DOCs, in Forms Authentication

Requesting Gravatar...
after download from sharepoint document library, into mobile web application PDA. whenever i wanna view perticular doc or pdf, it shud ask username and password. how can i do, plz guide me and will be thankful if explain with some sample code, THanks
Left by janardhan on Jun 08, 2009 12:34 AM

# re: Securing PDFs, DOCs, in Forms Authentication

Requesting Gravatar...
To simplify business intellegence, SharePoint is introduced. Working together will become easier with SharePoint. Others view SharePoint as something that cuts maintenance costs and it helps us focus more on higher priorities. - Marla Ahlgrimm


Left by Marla Ahlgrimm on Mar 13, 2012 8:54 AM

Your comment:

 (will show your gravatar)