Namespace AjaxUploader.Security

Classes

CloudUploadSession

The server-issued facts about a direct-to-cloud upload, carried in a tamper-proof token so later calls in the same upload cannot change them.

Why this exists. The presign flow is several requests: create, sign parts, complete, abort. Only create chooses the object key; every later call receives the key and upload id from the client. Without binding, a caller can send any key it likes and have parts presigned for it, or complete and abort uploads it did not start.

This is the Web Forms counterpart of CoreUpload's CloudUploadSession. It uses MachineKey - the .NET Framework equivalent of ASP.NET Core Data Protection - so key management follows the machine key configuration already used for view state and forms authentication. In a web farm the machine key must be explicitly configured and shared, exactly as it must be for view state.

RelativeUploadPath

Sanitizes the client-supplied folder-relative path that accompanies folder uploads (the relativePath form field / X-Upload-Relative-Path header / chunk-complete body property). The value is attacker-controlled text: it is never used to address storage directly - uploads are stored by GUID - but it is persisted and later handed to application code that may combine it into destination paths, so every traversal vector is removed here, once, before the value enters the system.

SigningAuthorization

Optional gate for the direct-to-cloud presign endpoints (ajaxupload.axd/s3/, /azure/, /gcs/*).

Those endpoints are privileged: whoever can call them can obtain credentials to write into your bucket or container. The handler is registered for the whole application, so a <location> rule on ajaxupload.axd would also gate ordinary uploads. This hook lets you authorize signing specifically.

Default (Handler left null) is permissive, preserving existing behavior. Set it once at startup:

// Global.asax Application_Start
AjaxUploader.Security.SigningAuthorization.Handler = (context, operation) =>
    context.User != null &&
    context.User.Identity.IsAuthenticated &&
    context.User.IsInRole("Uploaders");

Returning false answers 403. The check runs before the "signer not configured" branch, so a denied caller cannot learn which cloud providers a deployment has wired up.

This is the Web Forms counterpart of CoreUpload's IUploadAuthorizationHandler.AuthorizeSigningAsync.