Now it is a debate between me and m programmer.
I am creating a users file management system. simple, users upload files, and only authorized users can download the files.
the discussion, i am recommending to store the uploaded files in a folder named "userfiles" which is under App_Data folder so anyone can't download the files if he knows the direct URL of the file because it is not possible directly to download any file
from the app_data folder, we can download the file only through the application after verifying the authorization.
my programmer, want's to save the files in a folder named "userfiles" which is under root, but this can allow anyone to download the files who know direct url.
anyone want so support my point.
Go to the complete details ...