CODEWITHSUNDEEP
c#jqueryasp.netajaximage
jimmy
jimmy

Reputation: 756

securely show images on website

I currently store a number of document preview images (jpg/tif) outside of my web root. There are 100s of them, so having this work efficiently is important. The reason they are stored outside of the web root is that they contain data the only specific users/user groups may view (but each user can have 100s of documents they can view).

My current implementation is, when the user selects ‘view image’ an ajax call is triggered and this moves the image in question to a specific folder within the web root. The location is passed back and used to display the image to the user. When the next image is clicked, the call deletes any existing images and copies over the requested image. At session logout / timeout the users image folder is emptied. This has a few problems, but mainly:

  1. Files are constantly being copied and deleted
  2. There is the risk of images being left in the folder (issues with log off scripts)
  3. The whole time an images is in the folder it could be viewed by another users (unlikely but possible)

Is there a better way of doing this? I looked at trying to combine the BinaryReader with the ajax call (as I hoped this would cut out the need to copy the files), but can’t see how to get the data back to be used by the JS in the calling page.

Alternatively is there a way of making selected Folders only accessible to given users based on some session criteria? (I can’t imagine there is but I thought it’s worth asking.)

So if anyone has any ideas on how this can be improved that would be great. This is a c# ASP.NET app using Jquery.

Edit: The image is displayed using ajax, this allows for preloading and also means the rest of the page does not need to be reloaded when they select the next/previous image. It can almost be thought of as a javascript image swapper type situation, where the images are stored outside of the web root.

Thanks.

Upvotes: 0

Views: 433

Answers (3)

jimmy
jimmy

Reputation: 756

The issue was how to get an image to show via javascript that is not in the web root.

I created a generic handler (ashx file) that based on the session values (authentication) and submitted parameters would return an image.

That in turn is being called via AJAX.

Upvotes: 0

Zbyszek
Zbyszek

Reputation: 1482

Maybe try to write a method that will check user credentials by cookies, if it is not OK then load and send back some standard image that will say that user must log in to view file, if it is ok then load and show proper file from a path outside of root based on url parameter (with proper headers like content-type also often referred as mime-type ofc). Then link urls to that method with proper parameter(s).

You can easily find examples of code (like here) to display image in binary form from DB. You would need just to load them from some path outside of root, not DB.

Also you don't need to load it by AJAX - just add IMG with SRC pointing to URL of handler. Or redirect / open window if it needs to be downloaded not shown.

Upvotes: 0

Stan
Stan

Reputation: 26501

My current implementation is, when the user selects ‘view image’ an ajax call is triggered and this moves the image in question to a specific folder within the web root.

This is horrible idea. You realize you can just access the image data and pass it to web as stream with specific mime type, right?

Upvotes: 1

Related Questions