mapping other files to asp.net process

Have you already attempted securing the directory without
mapping the
.exe and .msi extensions to .net?  I haven't used the forms
auth for
this purpose so I'm not sure if the request to /<dir>
is halted or the
request to /<dir>/<file> is halted for
authentication.  If only /<dir>
then you'd be fine without mapping the extensions.

-----Original Message-----
From: Discussion of building .NET applications targeted for
the Web
[mailtoOTNET-WE
BDISCUSS.DEVELOP.COM] On Behalf Of Jeff
Sent: Thursday, July 20, 2006 5:41 PM
To: DOTNET-WEBDISCUSS.DEVELOP.COM
Subject: Re: [DOTNET-WEB] mapping other files to asp.net
process

Yes that's exactly what I was planning on doing. However my
concern is
mapping .exe to the aspnet process. I just want to consider
any security
back doors I am opening up here if any.

-----Original Message-----
From: Discussion of building .NET applications targeted for
the Web
[mailtoOTNET-WE
BDISCUSS.DEVELOP.COM] On Behalf Of Ian Suttle
Sent: Thursday, July 20, 2006 5:33 PM
To: DOTNET-WEBDISCUSS.DEVELOP.COM
Subject: Re: [DOTNET-WEB] mapping other files to asp.net
process

Jeff,

I assume these .exe and .msi files reside in a folder in the
same site
as the web application.  Specify the folder these files
reside in to
require forms authentication.  Then when a user attempts to
access a
file in the secured folder they'll be prompted to log in.

Ian Suttle
http://www.iansuttle.com

-----Original Message-----
From: Discussion of building .NET applications targeted for
the Web
[mailtoOTNET-WE
BDISCUSS.DEVELOP.COM] On Behalf Of Jeff
Sent: Thursday, July 20, 2006 5:29 PM
To: DOTNET-WEBDISCUSS.DEVELOP.COM
Subject: [DOTNET-WEB] mapping other files to asp.net process

We have some .exe files and .msi files that we want to lock
down to
forms
authenticated users.  I know I can map the extension to the
aspnet dll,
but
should I be concerned that some of the files are .exe ? will
this open
up
possible security issues for other .exe files to be
processed some how?



Is there some other way to do this that is more secure,
cleaner?



Thanks.


===================================
This list is hosted by DevelopMentor(r)  http://www.develop.com

View archives and manage your subscription(s) at
http://discuss.develop.com


===================================
This list is hosted by DevelopMentor.  http://www.develop.com

View archives and manage your subscription(s) at
http://discuss.develop.com


===================================
This list is hosted by DevelopMentor(r)  http://www.develop.com

View archives and manage your subscription(s) at
http://discuss.develop.com


===================================
This list is hosted by DevelopMentorŪ  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com