1,2) try this:

StatupFilter

   public class StartupFilter : IStartupFilter
    {
        public Action<IApplicationBuilder> Configure(Action<IApplicationBuilder> next) => app =>
        {
            app.UseMiddleware<AuthorizedMediaAccess>();
            next(app);
        };
    }

Startup.cs

 public void ConfigureServices(IServiceCollection services)
    {
        services.AddTransient<IStartupFilter, StartupFilter>();

        services.AddUmbraco(_env, _config)
            .AddBackOffice()
            .AddWebsite()
            .AddComposers()
            .Build();
    }

Middleware(InvokeAsync)

 public async Task InvokeAsync(HttpContext context, IMemberManager memberManager)
    {
        //If its not media, move on...

        if (!context.Request.Path.StartsWithSegments("/media"))
        {
            await _next(context);
        }
        else
        {
            if (context.User.Identity.IsAuthenticated)
            {
                await _next(context);
            }
            else
            {
                context.Response.StatusCode = 401;
            }
        }

    }

And remember to clear the cache!

"Clear the cache" YES! that was most of the problem with my first solution. But, Filters to the rescue. Thank you for this suggestion. It's mostly working now. The only issue remailing is that context.User.Identity is always null. Any idea on how to evaluate user this early on in the program's lifecycle?

I am trying to do this exact same thing right now, so I’m watching this thread with great interest.

That issue I think is likely that the startup filters are fired long before the umbraco middleware is fired and as a result we can't get the user. The above works from a filtering standpoint, however filtering on "/media" does not work from within the UseUmbraco(). AppBuilder.UseMiddleware for some reason. The media path is removed out the request pipeline at some point. This is so frustrating. So much obscured filtering and middlewares. I am on day two now... lol.

I actually have a really hacky approach working for protected images that involves passing the media ID to a web API endpoint, and that endpoint querying the image file path, loading the image into a PhysicalFile, and returning an actual image file as the response from the API. This doesn't protect the images at their real URLs, but provides a way to serve them with protection without revealing the unprotected URL. It's security-through-obscurity, but it could be sufficient in some cases.

The problem I ran into is that I need to also serve thumbnails that are processed through ImageSharp, and that has basically proven incompatible with the approach because I can't figure out how to get the physical file path of the cached ImageSharp thumbnails.

Just throwing some more thoughts out there to see if I can help:

One approach might be to implement a custom FileSystemProvider for ImageSharp that does access checking and then replicates the functionality of the standard PhysicalFileSystemProvider only when access is allowed, or maybe even calls into that existing implementation.

Relevant discussions:

https://our.umbraco.com/forum/umbraco-9/106879-umbraco-9-and-media-folder-location

https://github.com/umbraco/Umbraco-CMS/issues/11580#issuecomment-991716300

And after a little more experimentation and nudging from @bill-the-duck whos post here has since disappeared, after your call to app.UseAuthentication(); you can then test member related access via either the memberService (which you can inject via the constructor) and also you can method inject the IMemberManager if you want more performant results, Something like this:

public class CustomMediaAuthentication
    {
        private readonly RequestDelegate _next;
        private readonly IMemberService _memberService;

        public CustomMediaAuthentication(RequestDelegate next, IMemberService memberService)
        {
            _next = next;
            _memberService = memberService;
        }

        public async Task InvokeAsync(HttpContext context, IMemberManager memberManager)
        {
            //If its not media, move on...
            if (!context.Request.Path.StartsWithSegments("/media"))
            {
                await _next(context);
                return;
            }


            if (memberManager.IsLoggedIn()) //Authenticate user via memberManager through method DI
            {
                var member = _memberService.GetByUsername(context.User.Identity.Name); //Get member from _memberService
                var memberManagerMember = memberManager.GetCurrentMemberAsync(); //Get member from memberManager
                //Check out member permissions and do stuff....
                await _next(context);
                return;
            }

            // Stop processing the request and return a 401 response.
            context.Response.StatusCode = 401;
            await Task.FromResult(0);
            return;
        }
    }

Cheers!

Jamie

Crap. I did some very high level testing only. I will look into that a little deeper.

Have you tried something like this? (not tested)

public async Task InvokeAsync(HttpContext context, IMemberManager memberManager, IBackOfficeSecurityAccessor backOfficeSecurityAccessor )
        {
            //If its not media, move on...
            if (!context.Request.Path.StartsWithSegments("/media"))
            {
                await _next(context);
                return;
            }


            if (memberManager.IsLoggedIn() || backOfficeSecurityAccessor.BackOfficeSecurity.IsAuthenticated()) 
            {

                await _next(context);
                return;
            }

            // Stop processing the request and return a 401 response.
            context.Response.StatusCode = 401;
            await Task.FromResult(0);
            return;
        }

Actually, it may be that the issue with RTE images being cleared out is unrelated... it seems strange, but even after disabling app.UseCustomMediaAuthentication() in Startup.cs and restarting the site, I'm still having the issue. So it seems like there must be something else going on.

Thanks David, glad to hear that!

Hi - Thanks for the code - but when I browse to a media file for example: https://localhost:44333/media/63636/mytestfile.doc - as it exists the Middleware code doesn't get hit. The file automatically downloads.

But if I use a deliberate incorrect URL - still using media in the URL the code is hit.

Any ideas?

Yes - that did it - many thanks

Hi - if the code takes the user to the document the document doesnt download but takes them to a blank page.

If the doc is not allowed to view or in recycle bin - then I get a "failed" response in the Network instead of a 404

But if they are authorized, in your code, does the Media file still download OK? Im getting a failure even if the user is OK to view the document.

I have similar kind of implementation in my project, Trying to protect some media files from unauthorised users.

But those protected files are not loading up in the Umbraco backoffice, Is there a way to find the request from backoffice?

Tried using "backOfficeSecurityAccessor.BackOfficeSecurity.IsAuthenticated()" , But its always false.

The URL path actually starts with something like this "/media/fbndt65v/{filename}.{fileExtn}"

Right, since it's middleware, it's examining the current request for media.

backOfficeSecurityAccessor.BackOfficeSecurity.IsAuthenticated() occurs later in the request lifecycle so it wont work here.

Here is how I was able to achieve this:

 var backofficeLoggedIn = false;
 CookieAuthenticationOptions cookieOptions = _cookieAuthenticationsOptionsSnapshot.Get(Umbraco.Cms.Core.Constants.Security.BackOfficeAuthenticationType);
 string backOfficeCookie = context.Request.Cookies[cookieOptions.Cookie.Name!];
 if (!string.IsNullOrEmpty(backOfficeCookie))
 {
     AuthenticationTicket unprotected = cookieOptions.TicketDataFormat.Unprotect(backOfficeCookie!);
     ClaimsIdentity backOfficeIdentity = unprotected.Principal.GetUmbracoIdentity();
     backofficeLoggedIn = backOfficeIdentity.IsAuthenticated;
 }

Then:

if (_memberManager.IsLoggedIn() || backofficeLoggedIn) //Authenticate user via memberManager through method DI OR if user is an admin so they don't get media blocked from within the backoffice OR you can check with this method if (context.User.Identities.Any(IdentityExtensions => IdentityExtensions.IsAuthenticated))
{
    await _next(context);
    return;
}

Hmm that works for Umbraco 10/11. What are you on 13? If so I will take a look later as we are currently porting to 13.

Also, you need to DI the IOptionsSnapshot into the method like this:

public async Task InvokeAsync(
    HttpContext context,
    IMemberManager _memberManager,
    IOptionsSnapshot<CookieAuthenticationOptions> _cookieAuthenticationsOptionsSnapshot)
{...}

It works fine in v13, Thanks you.

is working on a reply...