title: Preventing direct access to files in IIS 7
body: <p>I have a PHP application running on a Micrisoft IIS 7 server. The application shows PDF files on an iFrame, which contains user's sensitive data that I wouldn't like to be directly accessed by anyone that knows the file address.</p>
  
  <p>So basically, I'm looking for a way to protect files from direct browser access or download, but still be able to show it on the application's iFrame.</p>
  
  <p>I made some research with Rewrite rules, but since the "HTTP_REFERER" of an iFrame is empty, I couldn't find a good solution</p>
  
  <p>Any suggestions for this?
  Thanks in advance</p>