title: Custom Authorization for all requests to sub-folder in ASP.NET website
body: <p>I have a ASP.NET 4.0 website which contains a sub-folder with multimedia files like JPG, PNG, MP4, MP3, etc.</p>
  
  <p>Currently, any user with the full link to the files is able to access the multimedia files without any restriction. I want to find the currently logged in user who is making the request and after checking their permissions from DB allow/disallow them to access the file requested.</p>
  
  <p>I have tried implementing a Custom <code>HttpModule</code> for this purpose but I am not able to find the current user making the request. Below is my code:</p>
  
  <pre><code>public class CustomHttpModule : IHttpModule
  {
      private const string URL_TO_LOOK_FOR = "/MultiMediaFiles/";
  
      public CustomHttpModule()
      { }
  
      public void Init(HttpApplication app)
      {
          app.AuthenticateRequest += CustomAuthenticateRequest;
          //app.EndRequest += CustomAuthenticateRequest;
      }
  
      void CustomAuthenticateRequest(object source, EventArgs e)
      {
          HttpApplication app = (HttpApplication)source;
          HttpContext context = app.Context;
          Uri url = context.Request.Url;
          if (url.AbsolutePath.StartsWith(URL_TO_LOOK_FOR, StringComparison.OrdinalIgnoreCase))
          {
              var response = context.Response;
              response.Clear();
              response.Write("app.Context.User :");
              if (context.User == null || context.User.Identity == null || context.User.Identity.Name == null)
              {
                  response.Write("No user");
              }
              else
              {
                  response.Write(context.User.Identity.Name);
              }
  
              response.End();
              response.Flush();
              response.Close();
          }
      }
  
      public void Dispose()
      { }
  }
  </code></pre>
  
  <p>I tried attaching to events: <code>BeginRequest</code>, <code>AuthenticateRequest</code>, <code>PostAuthenticateRequest</code> and even <code>EndRequest</code>, but in each case <code>context.User</code> is always <code>null</code> even after I have logged in to my website.</p>
  
  <p><strong>EDIT:</strong>
  I am using the <code>FormsAuthentication</code> and my web.config contains:</p>
  
  <pre><code>&lt;system.web&gt;
      &lt;authentication mode="Forms"&gt;
          &lt;forms name="MyWebFORMAUTH" timeout="60" 
                 loginUrl="~/web/logon/default.aspx" cookieless="UseCookies" 
                 defaultUrl="~/web/logon/default.aspx" 
                 slidingExpiration="true" /&gt;
      &lt;/authentication&gt;
  &lt;/system.web&gt;
  &lt;system.webServer&gt;
      &lt;modules&gt;
        &lt;add name="CustomHttpModule" type="CustomHttpModule"/&gt;
      &lt;/modules&gt;
  &lt;system.webServer&gt;
  </code></pre>
  
  <p><strong>NOTE:</strong> I cannot modify the links to multimedia files.</p>
  
  <p>Please HELP.</p>