把实际地址写入cs文件中，不要暴露在外，或者加密url

代码

//download.aspx.cs
protected void Page_Load(object sender, EventArgs e)
    {
        String fileUrl = Request.QueryString["file"].Trim().Replace("~", ""); 
        string DownloadFileName = Server.MapPath("~") + fileUrl;
        string filepath = DownloadFileName;
        string filename = System.IO.Path.GetFileName(filepath);
        Response.Clear();
        Response.ContentType = "application/octet-stream";
        Response.AddHeader("Content-Disposition", "attachment; filename=" + filename);
        Response.Flush();
        Response.WriteFile(filepath);
    }