IIS 虚拟文件夹 URL 加密
我们有 ac# asp.net Web 应用程序，除其他外，它允许用户下载以前上传的文件，例如 PDF、Word 文档等。asp.net 应用程序通过 IIS6 服务器提供服务，文件资源位于不同的服务器上服务器。
当用户请求文件时（即单击 Web 表单上的按钮），我们将文件流式传输回他们的浏览器，并相应地更改 ContentType。
这似乎是避免沿着 IIS 虚拟文件夹路径提供文件资源的好方法——我们担心用户可能会破解 URL。即 URL 类似于 https://mydomain/myresource/clientid/myreport.docx，精明的用户可以很好地猜测替代的 cvlientid 和文档名称。
将 Word 文档流式传输到浏览器的麻烦在于，当浏览器将其扔给 Word 时，Word 会将其视为全新文档，这意味着原始文档的属性和属性会被更改。保证金信息丢失。
我们的用户将元数据信息存储在 Word 文档属性中，因此他们无法接受此解决方案。
通过 IIS 虚拟文件夹提供服务解决了该问题，但引入了 URL 安全问题。
所以我的问题是...
有谁知道我们如何使用 IIS 虚拟文件夹进行 URL 加密/解密（或混淆）？
或者有人知道有任何开源项目可以完成类似的工作。
或者有人对如何使用加密的 URL 编写我们自己的虚拟文件夹实现有任何建议吗？
非常感谢。
附：我们的网络应用程序通过 https 交付
We have a c# asp.net web application that, amongst other things, allows users to download previously uploaded files such as PDF's, Word docs etc. The asp.net app is served up via an IIS6 server and the file resources live on a different server.
When the user requests a file (i.e. click a button on the web form), we stream the file back to their browser, changing the ContentType appropriately.
This seemed a good way to avoid going down the IIS virtual folder route to serve up the file resources - which we had concerns about due to the potential for users to hack the URL. i.e. with a URL like https://mydomain/myresource/clientid/myreport.docx, a savvy user could have a good stab at guessing alternative cvlientid's and document names.
The trouble with streaming a Word document to the browser is that when the browser throws it at Word, Word treats it as a brand new doc, which means the original document's properties & margin info is lost.
Our users store metadata information in the Word doc properties, so this solution is not acceptable to them.
Serving up via IIS virtual folders solves that problem, but introduces the URL security problem.
So my questions are ...
Does anyone know how we can use URL encryption/decryption (or obfuscation) with IIS Virtual folders?
Or does anyone know of any open source projects that do a similar job.
Or does anyone have any sugestions on how to go about writing our own implementation of Virtual folders but with encrypted URLs?
Many thanks in advance.
ps. our web app is delivered over https
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
抱歉各位，在我的问题中，我做了一些错误的假设。
我想要做的是将Word文档中存储的属性从服务器（使用Response.TransmitFile或通过虚拟文件夹）传递到客户端浏览器时保留它们。
我使用 IIS 虚拟文件夹设置了一个测试场景，并在虚拟文件夹的物理路径中放置了一个 docx 文件（我知道该文件包含标题和主题属性中的信息）。
我将浏览器指向虚拟文件夹别名，浏览器会弹出消息以打开或保存文档。
如果我选择保存它，保存的 docx 仍然具有完整的属性。
如果我选择先打开它，然后从 Word 中保存它，则保存的 docx 会丢失属性。
所以我想我需要提出一个不同的问题！
Sorry guys, in my question, I have made some incorrect assumptions.
What am I trying to do is persist the properties stored on a word document when they are delivered from server (using either Response.TransmitFile or via a virtual folder) to a client browser.
I set up a test scenario with an IIS virtual folder and dropped a docx file (that I know contains info in the title & subject properties) in my virtual folder's physical path.
I pointed my browser at the virtual folder alias and the browser popped up its message to either open or save the doc.
If I choose to save it, the saved docx still has the properties intact.
If I choose to open it fist and then save it from Word, the saved docx has lost the properties.
So I think I need to post a different question!
您可能会发现“Windows Identity Foundation”中的
ClaimsAuthorizationManager类可以实现您想要的功能。您可以实现任何您喜欢的逻辑来确定谁可以下载什么内容，而无需使用“目录安全性”。You may find that the
ClaimsAuthorizationManagerclass in "Windows Identity Foundation" does what you want. You get to implement whatever logic you like to determine who can download what without using "directory security".