Timeline for Prevent download of static files referenced only from pages a user is not authorized to access
Current License: CC BY-SA 4.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 16 at 10:53 | comment | added | Ewan | Ahh I didnt realise you were dynamically adding them. That kinda goes against the idea of static pages though. Its not a good idea to allow your website to write files to disk and then serve them. Instead use a database and dynamically serve the data | |
| May 16 at 9:52 | answer | added | pjc50 | timeline score: 4 | |
| May 16 at 9:43 | vote | accept | Francesco B. | ||
| May 16 at 8:50 | answer | added | freakish | timeline score: 4 | |
| May 16 at 8:10 | comment | added | Francesco B. | @Ewan thank you, those were exactly the same guides I was reading at first; the limitations I found in them (if we suppose I understood them correctly) are that "generic" mechanism are provided, i.e. for all static files, for static files with a given extension or just with "fixed" pages. My pages and files are added dynamically to the application, so I would need something "on the fly" rather than statically typed via a controller method or a known folder structure. Does this make any sense to you? | |
| May 16 at 8:08 | comment | added | Francesco B. | @freakish thanks, so much I didn't know about it! I won't be able to use a CDN due to some limitations for this project, are there any .NET packages you would recommend to manage URL signing directly from the server application? Anyway, if you make an answer out of your comment, I'll mark it as accepted. | |
| May 15 at 20:33 | comment | added | Ewan | learn.microsoft.com/en-us/iis/configuration/system.webserver/… | |
| May 15 at 20:30 | comment | added | Ewan | learn.microsoft.com/en-us/aspnet/core/fundamentals/… | |
| May 15 at 20:28 | comment | added | Ewan | generally web servers have authentication configuration that will work for static files no problem. what webserver are you using? | |
| May 15 at 20:02 | review | Close votes | |||
| May 30 at 3:04 | |||||
| May 15 at 17:04 | comment | added | freakish | The best solution is not to serve static html. But dynamically render them with urls that the user has access to. With this approach you can do this very efficiently by dynamically creating urls signed with expiration time. Then the content serving service only need to verify the signature and expiration time. No request to an external system is needed. Note that many CDNs provide url signing out of the box. | |
| S May 15 at 16:47 | review | First questions | |||
| May 16 at 6:55 | |||||
| S May 15 at 16:47 | history | asked | Francesco B. | CC BY-SA 4.0 |