[RESOLVED] HTTPModule is not working in production

[Harsh Gupta]

Hi all,

Say I have a link in a page to a file. Currently this displays the complete path to the file, e.g.

http://server/appname/folder1/folder2/file.extn

What I did, in the page containing the link, I opened a Download page in new window passing the name of the file etc. That worked. Now user don't see the complete path to the file. And it forces the user to login to the application thus helping us maintaining a log of who downloaded which file.

But this doesn't stop the user from entering the complete path to the file in the browser and downloading the file directly avoiding the download page. So I tried creating an HTTPModule wherein I tried to get the extension of the file being requested and if it is one of them in the list, then redirect the user to Unauthorized Access error page.

The code works fine in development but doesn't work in the production. By doesn't work, I mean that user can enter the path to the file and download it and this module doesn't seem to trap the request. Also this caused the Download page to stop working normally.

This is the code I was using:

public class BadRequest: IHttpModule
{
    public BadRequest()
    {
        //
        // TODO: Add constructor logic here
        //
    }
    public void Init(HttpApplication application)
    {
        application.BeginRequest += new EventHandler(application_BeginRequest);
        application.EndRequest += new EventHandler(application_EndRequest);
    }
 
    private void application_EndRequest(object sender, EventArgs e)
    {
        
    }
 
    private void application_BeginRequest(object sender, EventArgs e)
    {
        //HttpContext.Current.Response.Write(HttpContext.Current.Request.FilePath);
        //HttpContext.Current.Response.Write(VirtualPathUtility.GetExtension(HttpContext.Current.Request.Url.AbsolutePath));
        foreach (string block in System.Web.Configuration.WebConfigurationManager.AppSettings["blockExtn"].Split(new char[] { ';' }))
        {
            if (string.Equals(VirtualPathUtility.GetExtension(HttpContext.Current.Request.Url.AbsolutePath), block, StringComparison.OrdinalIgnoreCase))
            {
                HttpContext.Current.Response.StatusCode = 403;
                HttpContext.Current.ClearError();
                HttpContext.Current.Server.Transfer("~/ErrorPages/NoAccess.aspx");
            }
        }
    }
 
    public void Dispose() { }
}

In the Web.Config

<httpModules>
			<add name="BadRequest" type="BadRequest" />
		</httpModules>

Any ideas that I could try? Or am I missing something here?

Thanks