blocks|key|33826|text|是的，它们应该放在wwwroot中。目前还没有内置的方法来保护wwwroot目录。但是创建一个中间件模块来完成它是非常简单的。有一个简单易用的教程here。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|33827|如果您不熟悉开发中间件，我发布了一个GitHub项目，展示了如何通过三个简单的步骤创建中间件。您可以下载项目here。|33828|你不需要一个控制器来访问静态文件。|33829|entityMap|0|LINK|mutability|MUTABLE|url|http://odetocode.com/blogs/scott/archive/2015/10/06/authorization-policies-and-middleware-in-asp-net-5.aspx|1|https://github.com/ClintBailiff/MiddlewareDemo^0|9|7|V|7|21|4|0|0|1I|4|1|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|C]]|D|@$9|Y|A|Z|1|10]]|E|$]]|$1|F|3|G|5|6|7|11|8|@]|D|@$9|12|A|13|1|14]]|E|$]]|$1|H|3|I|5|6|7|15|8|@]|D|@]|E|$]]|$1|J|3|-4|5|6|7|16|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]|R|$5|M|N|O|E|$P|S]]]]

Yes, they should go in <code>wwwroot</code>. Currently there is no built-in way to secure <code>wwwroot</code> directories. But creating a middleware module to accomplish it is pretty straightforward. There is an easy to follow tutorial <a href="http://odetocode.com/blogs/scott/archive/2015/10/06/authorization-policies-and-middleware-in-asp-net-5.aspx" rel="noreferrer">here</a>.

If you're not familiar with developing middleware, I posted a GitHub project that shows how to create middleware in three easy steps. You can download the project <a href="https://github.com/ClintBailiff/MiddlewareDemo" rel="noreferrer">here</a>. 

You don't need a controller to access static files.

blocks|key|31921|text|在.net内核中，创建一个与wwwroot相同级别的专用目录www，并使用以下代码：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|31922|public+HomeController(IHostingEnvironment+hostingEnvironment)
{
++++_hostingEnvironment+=+hostingEnvironment;
}

[Authorize(Roles+=+"SomeRole")]
public+IActionResult+Performance()
{
++++return+PhysicalFile(Path.Combine(_hostingEnvironment.ContentRootPath,
+++++++++++++++++++++++++++++++++++++"www",+"MyStaticFile.pdf"),+"application/pdf");
}|code-block|syntax|javascript|31923|基于以下答案(针对.netCore)：static+file+authorization|offset|length|31924|entityMap|0|LINK|mutability|MUTABLE|url|https://medium.com/@tanaka_733/static-file-authorization-in-asp-net-core-mvc-26c1069073c1^0|0|0|J|P|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@]|9|@$I|V|J|W|1|X]]|A|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|L|$M|$5|N|O|P|A|$Q|R]]]]

in .net core create a dedicated directory www in same level as wwwroot, and use the following code:

<pre><code>public HomeController(IHostingEnvironment hostingEnvironment)
{
 _hostingEnvironment = hostingEnvironment;
}

[Authorize(Roles = "SomeRole")]
public IActionResult Performance()
{
 return PhysicalFile(Path.Combine(_hostingEnvironment.ContentRootPath,
 "www", "MyStaticFile.pdf"), "application/pdf");
}
</code></pre>

Based on the following answer (for .netCore): <a href="https://medium.com/@tanaka_733/static-file-authorization-in-asp-net-core-mvc-26c1069073c1" rel="noreferrer">static file authorization</a>

blocks|key|2496400|text|这是一个非常简单的示例，但是可以更改它以检查特定的角色，并且可以将代码移出Startup.cs以获得更大的灵活性。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2496401|app.Use(async+(context,+next)+=>
+++++++++++++++{
+++++++++++++++++++if+(!context.User.Identity.IsAuthenticated
+++++++++++++++++++++++&&+context.Request.Path.StartsWithSegments("/excelfiles"))
+++++++++++++++++++{
+++++++++++++++++++++++throw+new+Exception("Not+authenticated");
+++++++++++++++++++}
+++++++++++++++++++await+next.Invoke();
+++++++++++++++});|code-block|syntax|javascript|2496402|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

This is a very simple example, but it can be changed to check for specific roles, and the code can be moved out of the Startup.cs for more flexibility.

<pre><code>app.Use(async (context, next) =&gt;
 {
 if (!context.User.Identity.IsAuthenticated
 &amp;&amp; context.Request.Path.StartsWithSegments("/excelfiles"))
 {
 throw new Exception("Not authenticated");
 }
 await next.Invoke();
 });
</code></pre>

blocks|key|31938|text|如果您有一个登录表单(Login.html)，一个简单的解决方案是，如果用户未经过身份验证，并且他正在请求受保护的资源(+/protected文件夹下的文件)，则可以将用户重定向到登录页面。在Startup.cs中，在Configure方法中插入以下代码：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|31939|app.Use(async+(context,+next)+=>
{
++++if+(!context.User.Identity.IsAuthenticated+&&+context.Request.Path.StartsWithSegments("/protected"))
++++{
++++++++context.Response.Redirect("/Login.html");
++++++++return;
++++}
++++await+next.Invoke();
});|code-block|syntax|javascript|31940|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

If you have a login form (Login.html), a simple solution is to redirect the user to the login page if user is not authenticated and he's requesting a protected resource (file under /protected folder). In Startup.cs, in Configure method insert this code:

<pre><code>app.Use(async (context, next) =&gt;
{
 if (!context.User.Identity.IsAuthenticated &amp;&amp; context.Request.Path.StartsWithSegments("/protected"))
 {
 context.Response.Redirect("/Login.html");
 return;
 }
 await next.Invoke();
});
</code></pre>

blocks|key|32531|text|对于检索文件时的身份验证检查：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|32532|++++++++app.UseStaticFiles(new+StaticFileOptions()
++++++++{
++++++++++++OnPrepareResponse+=+(context)+=>
++++++++++++{
++++++++++++++++if+(!context.Context.User.Identity.IsAuthenticated+&&+context.Context.Request.Path.StartsWithSegments("/excelfiles"))
++++++++++++++++{
++++++++++++++++++++throw+new+Exception("Not+authenticated");
++++++++++++++++}
++++++++++++}
++++++++});|code-block|syntax|javascript|32533|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

For authentication check while retrieving file:

<pre><code> app.UseStaticFiles(new StaticFileOptions()
 {
 OnPrepareResponse = (context) =&gt;
 {
 if (!context.Context.User.Identity.IsAuthenticated &amp;&amp; context.Context.Request.Path.StartsWithSegments("/excelfiles"))
 {
 throw new Exception("Not authenticated");
 }
 }
 });
</code></pre>

I have a collection of Excel spreadsheets that I'd like to serve in my ASP.NET 5 webapp only to authorized users.

<ol>
<li>Where should I store the files? I assume in wwwroot (e.g., wwwroot/files).</li>
<li>If in wwwroot, how do I allow access only to authorized users? (I'd like to serve them up as a [Authorize] FileResult from the controller, but this still leaves the files open to direct access through a URL I believe.)</li>
<li>How do I reference a location in wwwroot through my FileResult action in the controller?</li>
</ol>

Thanks much!

How do I serve static files only to authorized users?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有一个Excel电子表格集合，我希望在我的ASP.NET 5 webapp应用程序中仅向授权用户提供这些表格。我应该将文件存储在哪里？我假设在wwwroot中(例如，wwwroot中的wwwroot/files).If )，我如何只允许授权用户访问？(我希望从控制器中将它们作为授权FileResult提供，但这仍然使...

问如何只向授权用户提供静态文件？
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何只向授权用户提供静态文件？EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何只向授权用户提供静态文件？
EN