<%@ Page Title="Authenticated Upload" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %> 
<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Authenticated Upload - AjaxUploader v5.2 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Authenticated Upload</asp:Content> 
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server"> 
<div class="demo-card"> <div class="demo-card-header">Authenticated Upload</div> <div class="demo-card-body"> <p class="demo-description"> Require authentication before allowing file uploads. Configure Forms Authentication
 in <code>web.config</code> so only logged-in users can access the upload page
 and handler.
 </p> <div class="mb-3" style="max-width:240px;"> <label class="form-label" for="authRoleSelect">Simulated user role</label> <select id="authRoleSelect" class="form-select"> <option value="Admin">Admin</option> <option value="Editor">Editor</option> <option value="Viewer">Viewer</option> </select> </div> <au:AjaxFileUpload ID="Uploader1" runat="server"
 AutoUpload="true"
 ShowProgress="true"
 ButtonText="Authenticated Upload" /> <div class="code-panel"> <pre><code>&lt;%-- web.config: Forms Authentication configuration --%&gt;
&lt;system.web&gt;
 &lt;authentication mode="Forms"&gt;
 &lt;forms loginUrl="~/Login.aspx" timeout="30" /&gt;
 &lt;/authentication&gt;
 &lt;authorization&gt;
 &lt;deny users="?" /&gt;
 &lt;/authorization&gt;
&lt;/system.web&gt;

&lt;%-- Protect the upload handler specifically --%&gt;
&lt;location path="upload.ashx"&gt;
 &lt;system.web&gt;
 &lt;authorization&gt;
 &lt;deny users="?" /&gt;
 &lt;/authorization&gt;
 &lt;/system.web&gt;
&lt;/location&gt;

&lt;%-- Code-behind: check authentication in upload handler --%&gt;
public class UploadHandler : IHttpHandler, IRequiresSessionState
{
 public void ProcessRequest(HttpContext context)
 {
 if (!context.User.Identity.IsAuthenticated)
 {
 context.Response.StatusCode = 401;
 context.Response.Write("Authentication required.");
 return;
 }

 string userId = context.User.Identity.Name;
 // Save file associated with the authenticated user
 if (context.Request.Files.Count == 0)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("No file was posted.");
 return;
 }

 HttpPostedFile file = context.Request.Files[0];
 string safeName = Path.GetFileName(file.FileName ?? string.Empty);
 if (safeName.Length == 0)
 {
 context.Response.StatusCode = 400;
 context.Response.Write("Invalid file name.");
 return;
 }
 file.SaveAs(Path.Combine(uploadDir, safeName));
 }
}</code></pre> </div> </div>
</div>
</asp:Content>
<asp:Content ID="ScriptsContent" ContentPlaceHolderID="ScriptsContent" runat="server">
<script> document.addEventListener('DOMContentLoaded', function () {
 var sel = document.getElementById('authRoleSelect');
 if (window.AjaxUploader && typeof AjaxUploader.getInstance === 'function') {
 var u = AjaxUploader.getInstance('Uploader1');
 if (u && u.options) u.options.headers = function () { return { 'X-User-Role': sel ? sel.value : 'Viewer' }; };
 }
 });
</script>
</asp:Content>
