TinyWeb permission denied reading a file
I am using TinyWeb to allow internal users to access files from a document storage system by hitting a url with a file id as an argument. Eg http://FileLink/1234-5678

I have to use Windows authentication with impersonation to query the document system which returns a valid filepath if the user has the correct access. Anonymous access is denied.

I am trying to use the default FileResult to return the file. This causes the browser to pop up a dialog for login details and then fails with this error.

System.UnauthorizedAccessException: Access to the path "SomeFile.PDF" Denied.


I have taken a look at the [FileResult code][1] and found that it fails on this line.

    response.WriteFile(FilePath);

Which in the end is using the HttpContext.Response.WriteFile to write the file to the response [as seen here][2].


If I clone the FileResult class and replace that line with the following, it will work perfectly and not prompt the user for login details.

    HttpContext.Current.Response.BinaryWrite(File.ReadAllBytes(FilePath));


I don't know why this works. I thought since I have used Windows Authentication with impersonation HttpContext.Response.WriteFile("MyFile.doc") should run as the logged in user?

Why does the HttpContext.Response.WriteFile fail and File.ReadAllBytes(FilePath) work?

Is there any way I can get the FileResult to work with out having to write my own nearly identical version?


  [1]: https://github.com/martinrue/Tinyweb/blob/master/src/tinyweb.framework/Handlers/HandlerResult/FileResult.cs
  [2]: https://github.com/martinrue/Tinyweb/blob/master/src/tinyweb.framework/Handlers/HandlerResult/Context/Default/DefaultResponseContext.cs
TinyWeb permission denied reading a file
===

I am using TinyWeb to allow internal users to access files from a document storage system by hitting a url with a file id as an argument. Eg http://FileLink/1234-5678

I have to use Windows authentication with impersonation to query the document system which returns a valid filepath if the user has the correct access. Anonymous access is denied.

I am trying to use the default FileResult to return the file. This causes the browser to pop up a dialog for login details and then fails with this error.

System.UnauthorizedAccessException: Access to the path "SomeFile.PDF" Denied.


I have taken a look at the [FileResult code][1] and found that it fails on this line.

    response.WriteFile(FilePath);

Which in the end is using the HttpContext.Response.WriteFile to write the file to the response [as seen here][2].


If I clone the FileResult class and replace that line with the following, it will work perfectly and not prompt the user for login details.

    HttpContext.Current.Response.BinaryWrite(File.ReadAllBytes(FilePath));


I don't know why this works. I thought since I have used Windows Authentication with impersonation HttpContext.Response.WriteFile("MyFile.doc") should run as the logged in user?

Why does the HttpContext.Response.WriteFile fail and File.ReadAllBytes(FilePath) work?

Is there any way I can get the FileResult to work with out having to write my own nearly identical version?


  [1]: https://github.com/martinrue/Tinyweb/blob/master/src/tinyweb.framework/Handlers/HandlerResult/FileResult.cs
  [2]: https://github.com/martinrue/Tinyweb/blob/master/src/tinyweb.framework/Handlers/HandlerResult/Context/Default/DefaultResponseContext.cs