title: Restrict static files access to authenticated users in ASP.Net
body: <p>we have an old asp.net web site (.Net 2.0), call it "ChildWeb" which has hundreds of pdf documents. Authentication for this website done by receiving a GUID from a parent website, call it "ParentWeb". Users will log in to the "ParentWeb" and then click on a link to navigate to the "ChildWeb".</p>
  
  <p>In "ChildWeb" there is a condition check to check if there is a GUID or some values in Sessions to allow the user. If there is non then user will be redirected to log in page of "ParentWeb".</p>
  
  <p>As this "ChildWeb" is not actually configured any authentication at the site level all the documents are exposed with out authentication if anybody know the URL for that document. I am looking for a way to fix this.</p>
  
  <p>What I am thinking is to configure the application to use Forms Authentication and set the redirect URL to the "ParentWeb" (they are under same domain) and let the "ParentWeb" redirect to a page in "ChildWeb" which is configured to allow anonymous access and set the FormAuthentication cookie in that page based on same GUID or Session variable check. Then I can make the folder that contains all the documents is accessible to only authenticated users.</p>
  
  <p>Are there any problems or risk with the above approach? Is there any other better approach by using Heep Handler or something else?</p>