c# - Obfuscate HTTP Handler designed to return image -

i'm trying retrieve image http handler.

an issue i'm having trying make application can access image, i've tried editing anonymous iis authentication allow application pool identity still lets users through.

here's example:

1. aspx page makes call handler (picservice.ashx?id=1) passing in id via query string
2. http handler sends image
3. the image source services/picservice.ashx?id=1

this works fine. if user wanted go , visit picservice.ashx , type in old id, return image correlates id. i'm working sensitive information isn't acceptable.

i've had @ http forbidden handlers i'm not sure whether i'm going down right route.

i've tried returning image in aspx page can't due image control needing url.

how can return image database , have source of image secure?

should doing different way? or on right track (http forbidden)?

a technique have used in past have page (step 1) create guid, , register cache item keyed guid has actual image url in object. page constructs url handler, using guid , passes handler

the handler (step 2) knows go cache actual value , return content.

this way expose temporary "magic" value. obfuscation , not substitute proper security.

as example (from memory, syntax may off bit)

in aspx or caller

    string keyvalue = guid.newguid().tostring();     int yourimageid = 5;      cache.add(keyvalue, yourimageid) //expire in 5 or 10 seconds     string url = "handler.ashx?imgid=" + httputility.urlencode(keyvalue);     response.redirect(url, false); 

in handler (i use ashx mostly, choose whatever suits need)

 string key = httputility.urldecode(context.request.querystring.get("imgid"));   int yourimageid = (int) context.cache.get(key);   //get image db , return content 

again, because used guid doesn't mean have to, if trying obfuscate identity, choose not correlate identity.