Protect download files

I´m developping an application that needs to show some videos, but in
a protected envinroment. Any user must be authenticated to see the
videos. But for example, if anyone know the path of the videos, can
access directly to this site and download it without authentication.

If I write in the location bar the url of a video, I can download
without problem because the application cannot test if the user is
already authenticated or not. I´ve read something about RedirectMatch
and it works well but now the users cannot see the videos.

I try to write an example:

..- #I write this rule in the httpd.conf
RedirectMatch (.*)\.avi$
/myapplication/tools/downloadfile.php?filename=$1

With this rule I redirect all the requests for the video files include
the request of a window media player, but I don´t want to do this.
When I show the video directly on the web, I don´t need to redirect
but when is a direct request from url to download the file, I must
check if the user is authenticated.

I hope that you can understand my bad english.

Fran García

.

Relevant Pages

  • RE: Redirect to default page using Windows Authentication
    ... The webserver may get intercept the request and return ... that error before I can do any type of redirect on the ... >authentication works is that if the resource you are ... >>confers no rights. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: how to time out the web asp.net application when not in use for 15 minutes
    ... I really think you'll have an easier time adopting Forms authentication. ... > when the session is time out asp.net application goes to session_end ... > How do I redirect now? ... >> there's no request, there's no where to transfer to. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Gracefully Handling Logged Out User
    ... > Session has nothing to do with Forms Authentication. ... > automatically redirect them to the login page. ... > The one issue you'll see is that, if the request which required ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Http Module -Multiple Projects
    ... If you implement the authentication code in HttpModule then you would end up in checking for all the page requests even if you dont need to authenticate a page. ... including Web Projects,, Depending on the functionality it gets ... I need to add redirect a set of request to a different page based on ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Gracefully Handling Logged Out User
    ... > it gracefully logs them out and asks them to log back on. ... Session has nothing to do with Forms Authentication. ... automatically redirect them to the login page. ... The one issue you'll see is that, if the request which required ...
    (microsoft.public.dotnet.framework.aspnet)