How to protect and let to download a purchased file by URL in the current session? Net Core 6.

Volk Volk 571

Hi!

I have a Ckeditor field with text on my page (the page is protected by authorization). There is a reference to the controller method in the text. How do I return a file for download from this method after some checks within the current session of an authorized user (so that no one can download this file without authorization and additional verification in the controller method).

Thanks!

AgaveJoe 26,191 Reputation points

2022-10-03T21:47:17.673+00:00

Simply place the file outside wwwroot and use a controller action to return the file. Then you can take advantage of standard authentication and authorization.
Zhi Lv - MSFT 32,011 Reputation points Microsoft Vendor

2022-10-04T06:18:05.543+00:00
Hi @Volk Volk ,

You can refer to the following articles: Static file authorization:

To serve static files based on authorization:

Store them outside of .wwwroot

Call , specifying a path, after calling .UseStaticFilesUseAuthorization

Set the fallback authorization policy.

An alternative approach to serve files based on authorization is to:

Store them outside of and any directory accessible to the Static File Middleware.wwwroot

Serve them via an action method to which authorization is applied and return a FileResult object:

so that no one can download this file without authorization and additional verification in the controller method

Then, you can use ASP.NET Core authorization and [Authorize] attribute to validate the user and protect the endpoint. If you want to add some additional verification, you could register the custom authorization handlers or create the custom Authorization attributes to validate the user. Refer to the following articles:

Create an ASP.NET Core web app with user data protected by authorization

Custom Authorization attributes

Best regards,
Dillion.
Volk Volk 571 Reputation points

2022-10-05T15:30:22.527+00:00
Thanks for the advice! Everything works, the reference comes in the same method Download(), so I added the downloading file name to string target = null.

public async Task<IActionResult> Download(
int id,
string target = null
)
{
...

var filePath = Path.Combine(_env.ContentRootPath, "Files", "Folder", "FileName"); return PhysicalFile(filePath, "unitypackage"); return View(inventory);

}

But I get an error:

Although I added this file type in the services.

var provider = new FileExtensionContentTypeProvider(); provider.Mappings[".unitypackage"] = MediaTypeNames.Application.Octet; app.UseStaticFiles(new StaticFileOptions { FileProvider = new PhysicalFileProvider( Path.Combine(env.ContentRootPath, "Downloads")), RequestPath = "/Files", ContentTypeProvider = provider });

Please tell me if I will stay on the same page after the file download starts? Because the code will not reach the line: return View(inventory); How do I download a file with the return PhysicalFile(filePath, "unitypackage") line; and stay on the same page (so that the return View(inventory) code is executed;)?

Thanks!
Zhi Lv - MSFT 32,011 Reputation points Microsoft Vendor

2022-10-06T02:51:18.393+00:00
Hi @Volk Volk ,

Which kind of file you want to download? The "unitypackage" is not a valid file's MIME type.

To download file, you can refer to the following code: it will download an image, so the content type is "image/png".

[HttpGet("download")] public IActionResult Download() { var filepath = Path.Combine(environment.WebRootPath, "images", "Image1.png"); return File(System.IO.File.ReadAllBytes(filepath), "image/png", System.IO.Path.GetFileName(filepath)); }
Volk Volk 571 Reputation points

2022-10-06T06:29:01.78+00:00

Yes, it works, thanks! Used "application/octet-stream". The question is closed. :)