Is it safe to map a virtual directory to a subfolder within App_Data for serving images? - asp.net

Question

I am running an mvc3 app under IIS7.
the general public can upload images via a file upload control, which resizes the images then writes them to a subfolder of the App_Data folder.
When it comes to displaying the uploaded images on pages, I cannot serve these straight from the App_Data subfolder because this is restricted by IIS7 as a protected folder for security reasons.
If i map a virtual directory to the App_Data subfolder i can serve the images stored in there, but this raises the question - does this pose a security risk?
From what i understand, as long as the correct permissions are set on the virtual directory, then it should be ok.
Is this correct? or are there other things i am overlooking?

Answer 1

From what i understand, as long as the correct permissions are set on the virtual directory, then it should be ok.
That's correct. If you ensure that only authorized users can access this virtual directory your files are pretty safe.
But to avoid all the hassle of creating another virtual directory you could create a controller action which will directly serve files from this folder:
// You could specify Roles instead of Users if you wish
[Authorize(Users = "john, jane")]
public ActionResult AppDataFile(string filename)
{
var file = Path.Combine(Server.MapPath("~/app_data"), filename);
if (!System.IO.File.Exists(file))
{
return HttpNotFound();
}
return File(file, "application/octet-stream", Path.GetFileName(file));
}
and then when you authenticate as jane you could /appdatafile?filename=foo.bar to download the foo.bar file from the App_Data folder.