iis security: Our users login (authenticate using db query to an SQL
server on .asp pages) to our website and from there they
see links that they can visit. If you don't login, you
don't see the links, just our intro page. The problem
is, if you have the URL to the file, you can get there
w/o logging in. What I want to know is... is there some
way to manipulate directory permissions on a folder so
that the object that has permissions is actually a piece
of code that querys a database for a list of permitted
users?

I think the problem lies in the security design and implementation of your
application.

You should consider storing all the secrets (resources you only want
authorized users to view) into a separate protected directory in IIS. You
can protect the folder by enabling IIS authentication and NTFS authorization
using ACLs.

With regards to your question on whether if there is a way to control access
to resource at code-level, you can consider using ASP.NET which allows you a
more granular authorization control at code access level. For more
information, you can refer to

INFO: Improving Web Application Security Guide
http://support.microsoft.com/?id=823195

HOW TO: Control Authorization Permissions in an ASP.NET Application
http://support.microsoft.com/?id=316871

cheers,
Desmond

[quoted text, click to view]

You can an ASP page, that:
a) checks the database for a list of approved users
b) if the user is approved, using the ADO Stream object to read the file off
the hard disk (store the files outside the webroot)
c) uses Response.BinaryWrite() to send the data to the client. You need to
set the appropriate ContentType headers

Cheers
Ken

[quoted text, click to view]
: Our users login (authenticate using db query to an SQL
: server on .asp pages) to our website and from there they
: see links that they can visit. If you don't login, you
: don't see the links, just our intro page. The problem
: is, if you have the URL to the file, you can get there
: w/o logging in. What I want to know is... is there some
: way to manipulate directory permissions on a folder so
: that the object that has permissions is actually a piece
: of code that querys a database for a list of permitted
: users?
: Thanks.