Disabling direct access to list and library

Question

I have a publishing site in which there are several lists and libraries.

I am displaying some list and libraries on home page and applied XSLT on them to give them desired look and feel.

There is a group called "Readers" which only has READ ONLY rights on site.

They can view the site but problem is they can also directly access the list as follows. I know they only have read only rights so they cannot do anything but still I don't want users be able to access lists directly or shall I say access system pages.

http://myserver/Lists/MyList/Allitems.aspx

If I give those users RESTRICTED READ rights they they cannot access the lists directly but then they can't browse site either.

Answer 1

AFAIK, It is not possible to do what you want to do, for fundamental reasons. The user controls the client. From the server side, the server has no way to distinguish a legitimate user from browser that happens to be making a request for the library(a case where you want to serve the file) from the same user who is trying to directly access the library(a case where you don't want to serve the file). These two situations are indistinguishable from the server's point of view, so the server has to behave the same way in both cases: either serve the library in both cases, or don't serve it.

You can only decide whether a user has access to the library or not, you cannot control what a determined user does with the library.

Answer 2

One of the possible way can be to restrict the user using HTTP module. But you need to wisely decide on this as it can hamper the performance of your site.

In HTTP module you can read the url and have conditions in place for navigating the user to some other page with the message..."You are not allowed to view this page".