protect download links, with expire time

n_wattam

i remember a couple of years ago coming across a very usefull script, it would encrypt your download link to a file, so the downloader couldnt find its real path and acess other downloads. Also the link would expire after x amount of time, meaning the link couldnt be passed on to others..

Good if you sell electronic files etc.

Problem is i cant find it or anything else like it? anyone know of a site i can find this.

MarkR

You could configure your web server to do basic authentication on those files. This would be the most reasonable thing to do.

If you use Apache, it is possible to set up htpasswd and htgroup files programmatically in PHP - this may be a useful technique.

Then you won't need to encrypt the link, it will ask for a username / password.

Of course the user could pass their account details to someone else too - but there's only so much you can do. They could equally send the downloaded file.

Mark

n_wattam

using username and password would create to much high maintence. The idea is a person sends there $$$ via paypal, then an email is sent out with the encrypted link, all self automated.

found this though... looks good

http://www.vibralogix.com/linklokurl/index.php

artlover

use session

n_wattam

can you elaberate, i cant see how sessions would work, as if a user after buying there electronic product online gets an email to there download link, how then would sessions aid in the following tasks:

Hide the location of where the file is stored, to prevent downloads of other files.
Disable the link after x period of time, so link cant be passed around for either bandwidth theft or distribution abuse etc.

Sesstions that i know of are only good if you are still on the site they purchaser buys there product for, so for example if i was selling somot on ebay i dont think they will let me use sessions 😃.

MarkR

Have a system which automatically sets up usernames / passwords in a htpasswd file for the buyers.

Once you know they've bought it, automatically email them the username / password. Store this somewhere with the date/time (you can put extra fields in htpasswd, they are ignored by Apache, you can use them for your own purposes).

Have a cron job which expires old passwords so they can't keep downloading.

It would require zero maintenance once set up.

Mark