How do you restrict file access to only the current user?

Ravi Vishwakarma 378 18 May 2025

Ravi Vishwakarma

IT-Hardware & Networking

Ravi Vishwakarma is a dedicated Software Developer with a passion for crafting efficient and innovative solutions. With a keen eye for detail and years of experience, he excels in developing robust software systems that meet client needs. His expertise spans across multiple programming languages and technologies, making him a valuable asset in any software development project.

1 Answers

Anubhav Sharma 22 May 2025

To restrict file access to only the current user, you need to associate uploaded files with the authenticated user and enforce authorization checks when serving or interacting with those files.

Step-by-Step Guide

1. Require Authentication

Ensure your app requires authentication for file upload and download:

[Authorize]
public class FileController : Controller
{
    // Upload/Download methods
}

2. Associate File with User on Upload

When a file is uploaded, store:

File name
Path
Upload time
User ID (e.g., from User.Identity.Name or User.FindFirst("sub"))

Example:

var userId = User.FindFirst("sub")?.Value ?? User.Identity.Name;

var savedFile = new UserFile
{
    FileName = Path.GetFileName(uploadedFile.FileName),
    FilePath = savedPath,
    UserId = userId,
    UploadedAt = DateTime.UtcNow
};

_db.UserFiles.Add(savedFile);
await _db.SaveChangesAsync();

3. Restrict Access When Serving Files

When a user tries to download or view a file, verify they are the owner:

public async Task<IActionResult> DownloadFile(int fileId)
{
    var userId = User.FindFirst("sub")?.Value ?? User.Identity.Name;

    var file = await _db.UserFiles
        .Where(f => f.Id == fileId && f.UserId == userId)
        .FirstOrDefaultAsync();

    if (file == null)
        return Forbid(); // Or NotFound()

    var fileBytes = await System.IO.File.ReadAllBytesAsync(file.FilePath);
    return File(fileBytes, "application/octet-stream", file.FileName);
}

Never serve a file without confirming ownership.

4. Secure File Storage Location

Store files outside the web root (e.g., not under wwwroot)
Use unique file names (e.g., GUID + extension) to avoid guessing

5. Use Claims or Roles if Needed

You can expand access control to allow:

Admins to view all files
Users to share files with others (via database permissions)

if (file.UserId != userId && !User.IsInRole("Admin"))
    return Forbid();

Summary

Security Measure	Why it Matters
Store UserId with file metadata	Tracks ownership
Check UserId before serving file	Prevents unauthorized access
Store files outside `wwwroot`	Prevents direct HTTP access
Use authentication/authorization	Protects all file endpoints
Use GUID-based file names	Prevents enumeration/guessing

forum

How do you restrict file access to only the current user?

Can you answer this question?

1 Answers

Step-by-Step Guide

1. Require Authentication

2. Associate File with User on Upload

3. Restrict Access When Serving Files

4. Secure File Storage Location

5. Use Claims or Roles if Needed

Summary