i have a client who wants to implement security on documents on his website. The documents are uploaded to website through CMS and can be accessed through actual website by users who have logged in via user name & pasword and thus authenticated. 

But if someone just know about the URL of that document he can simply type the url in browser window and can access the document. What is the easy way to secure these documents?

Secondly, is this possible to trace this access of documents(i.e by typing url in browser)? In other words I mean can global.asax's session_start is fired when i type something like this in browser http://www.mywebsite.com/documents/doc1.docx 

Hi,

Keep U Doc in App_Data Folder and Stream It when user Request It

http://usefulcodeincsharp.blogspot.com/2009/05/stream-data-directly-to-website-user.html

chk the above link...

OR

U may also Use Authrozation in Asp.net

Thanks for reply. Now I am having another problem. We have implemented ASp.Net URL authorization, access security on folders though memebersip and all is working fine on my local system. But when I try to access any secure folder on my remote hosting server following error occurs. If user has not loged in then things work fine i.e. he is redirected to the login page. But if user is logged and he tries to access document from a link on website, the following error occurrs. Please help it is really very urgent.

Server Error in '/' Application.

---

Failed to Execute URL.

[HttpException (0x80004005): Failed to Execute URL.]
   System.Web.Hosting.ISAPIWorkerRequestInProcForIIS6.BeginExecuteUrl(String url, String method, String childHeaders, Boolean sendHeaders, Boolean addUserIndo, IntPtr token, String name, String authType, Byte[] entity, AsyncCallback cb, Object state) +2004437
   System.Web.HttpResponse.BeginExecuteUrlForEntireResponse(String pathOverride, NameValueCollection requestHeaders, AsyncCallback cb, Object state) +393
   System.Web.DefaultHttpHandler.BeginProcessRequest(HttpContext context, AsyncCallback callback, Object state) +223
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +8679186
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +155

I encountered a problem similar to this a month ago and the company responsible for building my website said it has something to do with hosting problems.