How do you restrict file access to only the current user?

Question

Anubhav Kumar · Answer

To restrict file access to only the current user, you need to associate uploaded files with the authenticated user and
enforce authorization checks when serving or interacting with those files.
Step-by-Step Guide
1. Require Authentication
Ensure your app requires authentication for file upload and download:
[Authorize]
public class FileController : Controller
{
    // Upload/Download methods
}
2. Associate File with User on Upload
When a file is uploaded, store:
File namePathUpload timeUser ID (e.g., from User.Identity.Name or User.FindFirst("sub"))
Example:
var userId = User.FindFirst("sub")?.Value ?? User.Identity.Name;
var savedFile = new UserFile
{
    FileName = Path.GetFileName(uploadedFile.FileName),
    FilePath = savedPath,
    UserId = userId,
    UploadedAt = DateTime.UtcNow
};
_db.UserFiles.Add(savedFile);
await _db.SaveChangesAsync();
3. Restrict Access When Serving Files
When a user tries to download or view a file, verify they are the owner:
public async Taskandlt;IActionResultandgt; DownloadFile(int fileId)
{
    var userId = User.FindFirst("sub")?.Value ?? User.Identity.Name;
    var file = await _db.UserFiles
        .Where(f =andgt; f.Id == fileId andand f.UserId == userId)
        .FirstOrDefaultAsync();
    if (file == null)
        return Forbid(); // Or NotFound()
    var fileBytes = await System.IO.File.ReadAllBytesAsync(file.FilePath);
    return File(fileBytes, "application/octet-stream", file.FileName);
}
Never serve a file without confirming ownership.
4. Secure File Storage Location
Store files outside the web root (e.g., not under wwwroot)Use unique file names (e.g., GUID + extension) to avoid guessing
5. Use Claims or Roles if Needed
You can expand access control to allow:
Admins to view all filesUsers to share files with others (via database permissions)
if (file.UserId != userId andand !User.IsInRole("Admin"))
    return Forbid();
Summary
Security Measure
Why it Matters
Store UserId with file metadata
Tracks ownership
Check UserId before serving file
Prevents unauthorized access
Store files outside wwwroot
Prevents direct HTTP access
Use authentication/authorization
Protects all file endpoints
Use GUID-based file names
Prevents enumeration/guessing
and

forum

How do you restrict file access to only the current user?

Ravi Vishwakarma

Can you answer this question?

1 Answers

Step-by-Step Guide

1. Require Authentication

2. Associate File with User on Upload

3. Restrict Access When Serving Files

4. Secure File Storage Location

5. Use Claims or Roles if Needed

Summary

Liked By

Security Measure	Why it Matters
Store UserId with file metadata	Tracks ownership
Check UserId before serving file	Prevents unauthorized access
Store files outside `wwwroot`	Prevents direct HTTP access
Use authentication/authorization	Protects all file endpoints
Use GUID-based file names	Prevents enumeration/guessing