How does one hide the URL for a link to a file?

Question

I've got a C#, Kendo MVC, Razor site. There's a Kendo grid where one of the cells has a hyperlink to a pdf file, like this:

<a href="http://example.com/Files/File123.pdf" target="_blank">File 123</a>

Clicking on the link opens a pdf in a new browser tab. The problem is, the URL is visible in the browser and can be changed to see another file. For example, the user could replace 123 with 456 and see File456.pdf. I need to do two things:

1. Hide the filename in the URL when the pdf is opened.
2. Hide the URL when the user hovers over the hyperlink.

Alternatively, I'd take a way to click the link (without the user seeing the URL) and download the file, but I think whether to download or view the file is browser specific.

I would just create an event to send the user back to the controller and handle the opening or download there, but the Kendo grid complicates that and this, as usual, needs to be changed right away. I'll take suggestions on how to manipulate the Kendo row to open a pdf, but I'm hoping there's a simple way to change just hide the URL from the user.

Answer 1

The problem is, the URL is visible in the browser and can be changed to see another file.

In my opinion the correct approach in this case would be not to pretend to hide something from the user, but rather know who your users are and implement authorization on your server. This means that if user A attempts to access file 123 that belongs to user B he gets denied. But if he attempts to access file 124 that belongs to him, then why care that he modified the url in the browser? After all user A accessed his own file. So instead of serving a static file directly, you could put those files into a folder that is not directly accessible and serve them through a controller action that will apply the necessary authorization logic (does the file that the user is trying to access actually belong to him before serving it?).

So my advice in this case for you would be to implement authorization on your server based on the resources that he is trying to access.