Go Premium for a chance to win a PS4. Enter to Win

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 281
  • Last Modified:

ASP.Net: Getting "view_pdf.aspx?DocRef=12345" to return a PDF to the user

We have some PDF's that can be viewed by users. Rather than simply providing them with a link to the URL of the document, we would like some way to first check that they have permissions to view that PDF (by cross-referencing the PDF ref with the user ID in a database), then if they do have permissions to view it, return the PDF output to the page. Also, we don't want them to simply be able to guess the URL of other PDF's and be able to view them. Therefore, can somebody please confirm, and provide more code instead of the comments below:

Dim sDocRef As String
Dim bAccess As Boolean
Dim sDocLocation As String

sDocRef = Request.QueryString("DocRef")

' Query the database to check they have access to this file.
' Do SQL stuff.
If myRS("Access") = 1 Then
  ' Query the database to return the real location of the PDF
  ' Do SQL Stuff
  sDocLocation = myRS("Location")
  ' Set the content type of the page to be a PDF *****
  ' Read the contents of the PDF *****
  ' Output the contents of the PDF to the page *****
  Response.Redirect = "permission_denied.aspx"
End If

I.e. by going to "view_pdf?DocRef=12345" they are presented with the PDF in that same window [assuming have permissions].

Can somebody please provide the code where the comment has ***** at the end of it.

Any other bits of code in there would be helpful, e.g. check PDF exists, etc. are there any issues with this method?

Any help much appreciated.



  • 2
2 Solutions
Response.ContentType = "application/pdf"
Dim MyFileStream As FileStream
Dim FileSize As Long
 MyFileStream = New FileStream(sDocLocation , FileMode.Open)
 FileSize = MyFileStream.Length
Dim Buffer(CInt(FileSize)) As Byte
 MyFileStream.Read(Buffer, 0, CInt(FileSize))

James :-)

Dim PDFBuffer as Byte

' set the content type to PDF
Response.ContentType = "application/pdf"

' add content type header
Response.AddHeader("Content-Type", "application/pdf")

' set the content disposition
Response.AddHeader("Content-Disposition", "inline;filename=form.pdf")

' write the buffer with pdf file to the output

webtechyAuthor Commented:
Cheers, guys. So this method will work? i.e. it doesn't matter to the browser that the extension of the page will be .aspx but we are actually returning a PDF as we are setting the content type? Is this method the "best" for restructing access to PDF's?
This is the standard way to do it with any file type.

The content type tells the page what is actually being sent, not the extension. The extension is used by the web server to determine what the content type should be initially set to, but in a server-side environment like ASP/ASP.Net/PHP etc you can chnage this as we do above. Its the MIME type that is sent back as the content type that the client uses.

You can do this with a web page that is just a table as contents and tell it the content type is the MIME type for excel and it will open the web page in Excel with the page contents in the first workbook.

James :-)

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now