Securing files to registered

cnperry

I have this scheme in mind that I think will work well, and maybe is even the way to do this sort of thing.

There is a set of files for download that I want to be able to restrict to certain users. The solution I've come up with seems pretty reasonable, but I wanted to get some feedback before I proceed beyond the proof-of-concept to the real deal.

Everything is within the web root or below. I will put the secured files in the downloads directory and protect it by denying both indexing and access ("-Indexes" and "Deny from all" in the .htaccess file). So - a user can't just dig around the directory, hoping to find something - he'll get an access denied message from Apache. Qualified users will be directed to a download script that first checks proper qualifications, then proceeds to send the proper file headers and the file contents. It can be as simple as doing the following <img href="image.php?image=fname.jpg">, where the image.php is the script that checks quals then sends the image file via fread() or similar functions. Of course, that's not the best security, but you get the idea of how the file request could be handled. I suppose for added security filenames could be given some random hash, who's value is stored against some other known in a DB.

Ideas? Comments? Suggestions?

Thanks!
Cameron

planetsim

Why not have the files outside the web root. That stops users from accessing directly. Than use a PHP script to allow users access if there allowed too.

cnperry

Yes, that is another option I've considered, though not all hosting situations where my scripts might be deployed will have access outside the web root. I'm developing other features that will probably require safe_mode to be turned OFF, so keeping uploads and downloads outside the web root isn't aboslutely necessary.

It's also true that I can simply specify an additional variable to determine where the directory is located, which may be an option, however when it comes time that the software is actually ready for public use I want the install to be easy as possible.