Secure file downloads

Kilo

I want to be able to dynamically generate csv files for users, make them available to download - but only to that particular user.

Generating the csv file isn't a problem, but in order to ensure that no random person can download it I presume I'm to save it outside of the web root? So having done this, I can write a php script to verify the user's details, but how do I make it then send the user the file?

Yes that summerizes it - how to I get a php script to output a file?

morphy_6deex

interested... should that download have problems with https?

Kilo

Hopefully it'll only happen down https, but that's another hurdle for later maybe...!

jvilimek

Yes that summerizes it - how to I get a php script to output a file?:

just put in header the right "content" (content=zip/gzip for ex.) and then use read_file or somethink like this that outputs content to the script

Kilo

Thanks jvilimek

So I can use this method to send a file from outside the web root?

jvilimek

course.

morphy_6deex

but with "standard" headers i get herror with https... any idea?

Kilo

This works, in as much as it sprews the file out into the browser window. I actually want it to download the csv -- how do I get this to happen?

TIA

jvilimek

you must have set correct header (search in php manual for examples) to avoid "seeing file content in browser window" for then it recognize the begin of download and opens "save as ..." window.
Do not have any idea with this https stuff...