Run MediaRequestHandler after Session_Start for authentication purposes

Question

The media library images in our solution are protected by a custom override on the Sitecore MediaRequestHandler. This, in turn, checks against some Sitecore configuration item whether or not a user is permitted to access this media item or pdf. This system works great once a session is already started.

If a user tries to access the media item directly by URL in a new session, the MediaRequestHandler checks if a user is permitted to access the media item before our (custom, not Sitecore based) autologin system in Global.asax.cs in Session_Start has the chance to auto-login the user. Of course, once the user tries to access the media item again, everything works as expected, because then the session is already established.

Is there a way to change the order of the media request handler so that it only fires after Session_Start?

Answer 1

I've been looking at the code in the MediaRequestHandler - the one that is wired in to handle your media requests.

<add verb="*" path="sitecore_media.ashx" type="Sitecore.Resources.Media.MediaRequestHandler, Sitecore.Kernel" name="Sitecore.MediaRequestHandler"/>

It basically has some custom handling around handling user login requirements and calls some internal methods to try and fix that. Rewriting this logic would probably be a lot more pain that it is worth.

The alternative would be, to force a session to be active for this HttpHandler. Be aware of the potential for resource cost this may have on your server.

The way to do it, would be to implement your own handler - inheriting from Sitecore's - and patch it in, in the config snippet I showed above. Something like:

public class SessionMediaRequestHandler : Sitecore.Resources.Media.MediaRequestHandler, IReadOnlySessionState
{
}

That might actually be all the code you need. The IReadOnlySessionState will make sure a session gets triggered before the handler is called - which in turn should trigger your custom code.

Reference: Getting Session State in HttpHandlers (ASHX files)