[RESOLVED] HTTPModule is not working in production

[Harsh Gupta]

Hi all,

Say I have a link in a page to a file. Currently this displays the complete path to the file, e.g.

http://server/appname/folder1/folder2/file.extn

What I did, in the page containing the link, I opened a Download page in new window passing the name of the file etc. That worked. Now user don't see the complete path to the file. And it forces the user to login to the application thus helping us maintaining a log of who downloaded which file.

But this doesn't stop the user from entering the complete path to the file in the browser and downloading the file directly avoiding the download page. So I tried creating an HTTPModule wherein I tried to get the extension of the file being requested and if it is one of them in the list, then redirect the user to Unauthorized Access error page.

The code works fine in development but doesn't work in the production. By doesn't work, I mean that user can enter the path to the file and download it and this module doesn't seem to trap the request. Also this caused the Download page to stop working normally.

This is the code I was using:

public class BadRequest: IHttpModule
{
    public BadRequest()
    {
        //
        // TODO: Add constructor logic here
        //
    }
    public void Init(HttpApplication application)
    {
        application.BeginRequest += new EventHandler(application_BeginRequest);
        application.EndRequest += new EventHandler(application_EndRequest);
    }
 
    private void application_EndRequest(object sender, EventArgs e)
    {
        
    }
 
    private void application_BeginRequest(object sender, EventArgs e)
    {
        //HttpContext.Current.Response.Write(HttpContext.Current.Request.FilePath);
        //HttpContext.Current.Response.Write(VirtualPathUtility.GetExtension(HttpContext.Current.Request.Url.AbsolutePath));
        foreach (string block in System.Web.Configuration.WebConfigurationManager.AppSettings["blockExtn"].Split(new char[] { ';' }))
        {
            if (string.Equals(VirtualPathUtility.GetExtension(HttpContext.Current.Request.Url.AbsolutePath), block, StringComparison.OrdinalIgnoreCase))
            {
                HttpContext.Current.Response.StatusCode = 403;
                HttpContext.Current.ClearError();
                HttpContext.Current.Server.Transfer("~/ErrorPages/NoAccess.aspx");
            }
        }
    }
 
    public void Dispose() { }
}

In the Web.Config

<httpModules>
			<add name="BadRequest" type="BadRequest" />
		</httpModules>

Any ideas that I could try? Or am I missing something here?

Thanks

[mendhak]

Try to start by emulating the production environment. I'm guessing, and this is a common case, that the development url is http://localhost/abc.ext and on production it is http://example.com/abc.ext.

Edit your hosts file and have example.com point to 127.0.0.1, then in IIS, create the site as a website rather than virtual directory and give it a host header of example.com.

Next, run in debug mode and attempt to browse to example.com/abc.ext. It should hit a breakpoint. Follow from there.

[Harsh Gupta]

Hey,

I tried doing what you said. But failed miserably. Maybe there is something I must tell:

1) The website was/is hosted on internal server and used by internal employees. So there they access this with IP Address. Like http://10.10.10.10/virtualdir/... and so on.

2) When I tried to emulate what you said, I couldn't start the website when I added the IP Address as Host Header. If I leave it blank, or add some random domain name, this seems to work.

3) Currently, in development, I am using ASP.Net Development server and not IIS. But I guess, this should make a difference.

So there was actually no difference between development and hosting environment, atleast to my knowledge.

[mendhak]

Yeah, it makes a difference - IIS can handle host headers but VSDS cannot handle host headers. Make a virtual directory pointing at the directory where your pages are, then simply run your application. It'll sit and wait. Now when you browse to it you should see it hit breakpoints, etc.

[Harsh Gupta]

All right.

I am not in that client's place now, so the issue isn't an issue anymore. Now I would like to learn why it isn't working on localhost.

I tried hosting the website on localhost (IIS on my local system). Placed a breakpoint in the module code. It was hit for all request except when directly accessing the file. I was able to download the file with module code working.

Is there any alternative to stop user from directly accessing the file(s) not handled by the IIS?

[mendhak]

Have you added that file extension in the configuration section for the virtual directory in IIS? You must know about it... an extension can be mapped to an ISAPI DLL.

[Harsh Gupta]

Have you added that file extension in the configuration section for the virtual directory in IIS? You must know about it... an extension can be mapped to an ISAPI DLL.

Well ye.....ummmm....I forgot that.

:runs away:

[mendhak]